CVE-2021-35464

ForgeRock OpenAM / AM Server – Pre-Auth Java Deserialization RCE (CVE-2021-35464)

AI-generated analysis based on the vulnerability data on this page.

Summary

ForgeRock Access Management (formerly OpenAM) contains a critical unauthenticated Java deserialization vulnerability in the legacy Sun ONE Application Framework (JATO) component. A single crafted request to the /ccversion/* endpoint can trigger remote code execution on the server without prior authentication.

Background

ForgeRock Access Management (AM) and its predecessor OpenAM are widely used identity and access management platforms that provide single sign-on, federation, and authorization services for enterprise applications. Versions of the product built on Java 8 or earlier retain the legacy JATO framework, which is the root of this vulnerability. The framework is used to manage page state via serialized Java objects passed through the jato.pageSession parameter.

Root Cause

CWE-502 – Deserialization of Untrusted Data

The JATO framework within ForgeRock AM deserializes attacker-controlled Java objects provided via the jato.pageSession parameter. The application does not validate the type or content of the serialized objects before passing them to the Java deserialization engine. This allows the injection of arbitrary serialized objects, including gadget chains that lead to remote code execution. The vulnerability exists because JATO was not designed for modern security boundaries and was discontinued by its original vendor; its presence in the Java 8-era code path continues to expose deserialization surface.

Impact

This is a Critical severity vulnerability with a CVSS v3 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

• Network Vector (AV:N) – The vulnerability is exploitable remotely over the network.
• Low Attack Complexity (AC:L) – No special conditions are required beyond the ability to reach the target.
• No Authentication (PR:N) – The attacker does not need any credentials or prior access.
• No User Interaction (UI:N) – The attack is fully automated.
• High Impact on Confidentiality, Integrity, and Availability (C:H/I:H/A:H) – Successful exploitation yields complete compromise of the server.

The EPSS score of 0.99999 with a percentile of 0.99993 indicates that exploitation in the wild is extremely probable, and the CISA KEV catalog confirms this vulnerability has been actively exploited since November 2021.

Exploitation Walkthrough

Disclaimer: This walkthrough is provided for defensive purposes only. It describes the attack surface and indicators to help defenders detect and mitigate the risk. No weaponized exploit code is provided.

1. Reconnaissance – The attacker identifies an exposed ForgeRock AM or OpenAM instance by probing the /ccversion/* path or similar JATO endpoints.
2. Crafting the Payload – The attacker generates a serialized Java object that contains a malicious gadget chain (commonly leveraging libraries such as Apache Commons Collections or similar classes present on the classpath).
3. Delivery – The payload is Base64 encoded and placed into the jato.pageSession parameter in an HTTP POST request to the vulnerable endpoint.
4. Deserialization Trigger – The server receives the request, decodes the parameter, and passes the raw bytes to the Java ObjectInputStream.readObject() method.
5. Code Execution – The gadget chain executes during deserialization, giving the attacker a reverse shell, web shell, or direct command execution on the host.

Defensive Note: Even without knowing the exact payload, defenders can monitor for large or unusual Base64 blobs in jato.pageSession and unexpected outbound connections from the AM server.

Affected and Patched Versions

ForgeRock’s official knowledge base article confirms that AM 7.0 and later are not affected.

Remediation

Immediate Actions

1. Upgrade to ForgeRock AM 7.0 or later – This is the definitive fix.
2. Patch/Upgrade Java – If immediate upgrading is not possible, ensure you are running a patched version of the application and Java runtime.
3. Remove or Disable JATO Endpoints – If your deployment does not require the legacy /ccversion/* JATO pages, disable or block access to those URL patterns at the reverse proxy or web application firewall level.

Compensating Controls

• Web Application Firewall (WAF) – Deploy rules that inspect the jato.pageSession parameter for unusually large Base64 strings and block requests containing suspicious serialized objects.
• Network Segmentation – Restrict access to the AM admin and internal endpoints to trusted management networks only.
• Runtime Application Self-Protection (RASP) – Use a RASP or Java agent that can detect and block deserialization of untrusted classes.
• JEP 290 / JEP 415 – If supported by your Java runtime, enable the deserialization filter (ObjectInputFilter) to block known gadget classes.

Detection

Consider creating a detection rule in your SIEM for any HTTP request containing jato.pageSession that exceeds a normal length threshold (e.g., > 500 bytes).

Assessment

With an EPSS of 0.99999 and a confirmed KEV listing, this vulnerability is one of the highest-probability exploitation targets in enterprise environments. Attackers routinely scan for exposed OpenAM/AM servers because the vulnerability is unauthenticated and trivial to weaponize.

Lessons:

1. Legacy frameworks carry hidden risk. Discontinued or deprecated components such as JATO can reintroduce critical vulnerabilities years after their end-of-life.
2. Pre-authentication RCE is a worst-case scenario. The combination of network access, no credentials, and low complexity means that exploitation is inevitable for any internet-facing instance without rapid patching or strong compensating controls.

References

• http://packetstormsecurity.com/files/163486/ForgeRock-OpenAM-Jato-Java-Deserialization.html
• http://packetstormsecurity.com/files/163525/ForgeRock-Access-Manager-OpenAM-14.6.3-Remote-Code-Execution.html
• https://backstage.forgerock.com/knowledge/kb/article/a47894244
• https://bugster.forgerock.org
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35464