PT-2018-7255 · Midnight Coders · Weborb For Java

Published 2018-06-11 · Updated 2018-08-06 · CVE-2017-3208

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WebORB for Java version 5.1.1.0

Description: The issue concerns the Java implementation of AMF3 deserializers in WebORB for Java, which allows external entity references (XXEs) from XML documents embedded within AMF3 messages. This could potentially expose sensitive data on the server, lead to denial of service, or enable server-side request forgery.

Recommendations: For version 5.1.1.0, consider disabling the AMF3 deserialization functionality until a patch is available to prevent potential exploitation. Restrict access to sensitive data on the server and monitor for signs of denial of service or server-side request forgery.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2017-3208

Affected Products

Weborb For Java

References · 6

• 🔥 https://codewhitesec.blogspot.com/2017/04/amf.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-3208 · Security Note
• https://osv.dev/vulnerability/CVE-2017-3208 · Vendor Advisory
• http://securityweek.com/flaws-java-amf-libraries-allow-remote-code-execution · Note
• http://securityfocus.com/bid/97384 · Note
• https://kb.cert.org/vuls/id/307983 · Note