CVE-2021-35464: ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability
ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier
Other sources
ForgeRock Access Management (AM) Core Server allows an attacker who sends a specially crafted HTTP request to one of three endpoints (/ccversion/Version, /ccversion/Masthead, or /ccversion/ButtonFrame) to execute code in the context of the current user (unless ForgeRock AM is running as root user, which the vendor does not recommend).
— CISA
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-35464?
CVE-2021-35464 is a Java deserialization vulnerability in the ForgeRock Access Management (AM) Core Server.
What is the severity of CVE-2021-35464?
CVE-2021-35464 has a severity rating of critical.
How does CVE-2021-35464 work?
CVE-2021-35464 allows remote code execution by exploiting a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages of the ForgeRock AM server.
Do I need authentication to exploit CVE-2021-35464?
No, CVE-2021-35464 exploitation does not require authentication.
How can I fix CVE-2021-35464?
To fix CVE-2021-35464, you should upgrade your ForgeRock AM server to version 7.0 or newer.