PT-2018-7251 · Flamingo · Flamingo Amf-Serializer

Markus Wulftange · Published 2018-06-11 · Updated 2022-05-13 · CVE-2017-3202

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Flamingo amf-serializer version 2.2.0

Description: The Java implementation of AMF3 deserializers in Flamingo amf-serializer may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. This could potentially lead to arbitrary code execution when deserialized. The ability to exploit this issue depends on the availability of classes in the class path that make use of deserialization. A remote attacker with the ability to spoof or control information may be able to send serialized Java objects with pre-set properties.

Recommendations: For version 2.2.0, consider restricting the use of the AMF3 deserializers until a patch is available. As a temporary workaround, restrict access to classes in the class path that make use of deserialization to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-913

Related Identifiers

CVE-2017-3202

GHSA-J88V-Q3VW-P9VR

Affected Products

Flamingo Amf-Serializer

References · 7

• 🔥 https://codewhitesec.blogspot.com/2017/04/amf.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-3202 · Security Note
• https://osv.dev/vulnerability/GHSA-j88v-q3vw-p9vr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-3202 · Vendor Advisory
• http://securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution · Note
• http://securityfocus.com/bid/97380 · Note
• https://kb.cert.org/vuls/id/307983 · Note