PT-2018-7254 · Midnight Coders · Weborb For Java

Published 2018-06-11 · Updated 2019-10-09 · CVE-2017-3207

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WebORB for Java version 5.1.1.0

Description: The issue concerns the Java implementations of AMF3 deserializers in WebORB for Java, which derive class instances from java.io.Externalizable instead of following the AMF3 specification's recommendation of flash.utils.IExternalizable. This could allow a remote attacker, who has the ability to spoof or control an RMI server connection, to send serialized Java objects that execute arbitrary code when deserialized.

Recommendations: For WebORB for Java version 5.1.1.0, consider updating to a version that adheres to the AMF3 specification's recommendation for deserialization, or apply a patch if available, to prevent arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2017-3207

Affected Products

Weborb For Java

References · 6

• 🔥 https://codewhitesec.blogspot.com/2017/04/amf.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-3207 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3207 · Security Note
• http://securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution · Note
• http://securityfocus.com/bid/97384 · Note
• https://kb.cert.org/vuls/id/307983 · Note