Critical RCE Flaw in ForgeRock Access Manager Under Active Attack
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-35464 | Java Deserialization RCE in ForgeRock Access Management (AM) ForgeRock Access Management (AM) Core Server contains a Java deserialization flaw (CWE-502, deserialization of untrusted data) that allows remote code execution. An attacker triggers it by sending a specially crafted HTTP request carrying malicious serialized data to one of three web endpoints: /ccversion/Version, /ccversion/Masthead, or /ccversion/ButtonFrame. Successful exploitation executes arbitrary code in the context of the AM service account, which per the vendor is typically a non-root user, so the attacker gains the privileges of the application process on that server. Any organization running ForgeRock AM Core Server is affected, especially where the /ccversion/ endpoints are reachable by untrusted networks. The flaw is being actively exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, EPSS assigns a 100% probability of exploitation within 30 days, and no public PoC is tracked in the source data. Do: Apply ForgeRock's update per vendor instructions (the CISA KEV required action), prioritizing internet-facing AM servers. As an interim mitigation, block or restrict access to the /ccversion/ endpoints (e.g., /ccversion/*) at a reverse proxy or WAF, and ensure AM runs under a non-root service account. Because ransomware use is known, review access logs for requests to /ccversion/Version, /ccversion/Masthead, and /ccversion/ButtonFrame and treat any exposed, unpatched host as potentially compromised. | 9.8 | 100% | KEV ransomware PoC ×3 |
| moderate≈1,000–10,000 internet-exposed ForgeRock AM/OpenAM servers, with additional uncounted internal deployments |
Full article271 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJul 13, 2021
Cybersecurity agencies in Australia and the U.S. are warning of an actively exploited vulnerability impacting ForgeRock's OpenAM access management solution that could be leveraged to execute arbitrary code on an affected system remotely.
"The [Australian Cyber Security Centre] has observed actors exploiting this vulnerability to compromise multiple hosts and deploy additional malware and tools," the organization said in an alert. ACSC didn't disclose the nature of the attacks, how widespread they are, or the identities of the threat actors exploiting them.
Tracked as CVE-2021-35464, the issue concerns a pre-authentication remote code execution (RCE) vulnerability in ForgeRock Access Manager identity and access management tool, and stems from an unsafe Java deserialization in the Jato framework used by the software.
"An attacker exploiting the vulnerability will execute commands in the context of the current user, not as the root user (unless ForgeRock AM is running as the root user, which is not recommended)," the San Francisco-headquartered software firm noted in an advisory.
"An attacker can use the code execution to extract credentials and certificates, or to gain a further foothold on the host by staging some kind of shell (such as the common implant Cobalt Strike)," it added.
The vulnerability affects versions 6.0.0.x and all versions of 6.5, up to and including 6.5.3, and has been addressed in version AM 7 released on June 29, 2021. ForgeRock customers are advised to move quickly to deploy the patches to mitigate the risk associated with the flaw.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2021/07/critical-rce-flaw-in-forgerock-access.html