PT-2017-3932 · Apache+1 · Apache Flex Blazeds+1

Pedrib1337 + 1 · Published 2017-04-13 · Updated 2022-05-13 · CVE-2017-5641

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Flex BlazeDS versions 4.7.2 and earlier

Description The issue is related to the deserialization process in Apache Flex BlazeDS, where code is executed that can have undesired side-effects for several known types. This can potentially allow an attacker to trigger further exploitable Java deserialization of untrusted data, and in some cases, remote code execution. The vulnerability may be exploited by a remote attacker to execute arbitrary code when deserializing an untrusted Java object.

Recommendations For Apache Flex BlazeDS versions 4.7.2 and earlier, consider restricting the types allowed for AMF(X) object deserialization to prevent potential exploitation. As a temporary workaround, consider disabling the deserialization of untrusted data until a patch is available. Restrict access to the vulnerable component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2020-01110

CVE-2017-5641

GHSA-W8V7-PRHW-XJPW

ZDI-22-506

ZDI-22-507

Affected Products

Apache Flex Blazeds

Vmware Vcenter

References · 22

• 🔥 https://github.com/pedrib/PoC/blob/master/advisories/Cisco/DCNMPwn.md#1-unsafe-flex-amf-java-object-deserialization · Exploit
• 🔥 http://seclists.org/fulldisclosure/2018/Apr/40 · Exploit
• https://issues.apache.org/jira/browse/FLEX-35290 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-506 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-5641 · Security Note
• https://bdu.fstec.ru/vul/2020-01110 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-507 · Security Note
• https://osv.dev/vulnerability/CVE-2017-5641 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w8v7-prhw-xjpw · Vendor Advisory
• https://github.com/apache/flex-blazeds/commit/11b0aa132d9a43bf81fa12654ff227ff247b4627 · Note
• https://github.com/apache/flex-blazeds/commit/f861f0993c35e664906609cad275e45a71e2aaf1 · Note
• https://github.com/apache/flex-blazeds · Note
• https://moxa.com/en/support/support/security-advisory/oncell-central-manager-cellular-management-software-vulnerabilities · Note
• https://kb.cert.org/vuls/id/307983 · Note
• http://mail-archives.apache.org/mod_mbox/flex-dev/201703.mbox/[e-mail]%3E · Note