OpenAM Pre-Authentication RCE via JATO ClientSession Deserialization

OpenIdentityPlatform OpenAM 16.0.5, and likely earlier versions, is susceptible to a critical pre-authentication Remote Code Execution (RCE) vulnerability. This flaw stems from the unsafe Java deserialization of the jato.clientSession HTTP parameter. Unlike the patched jato.pageSession parameter (CVE-2021-35464), jato.clientSession lacks proper input validation, allowing an unauthenticated attacker to inject a malicious serialized Java object. Successful exploitation grants the attacker the ability to execute arbitrary operating system commands with the privileges of the application server user. The vulnerability affects any OpenAM deployment that exposes a JATO endpoint with <jato:form> tags in its JSP pages, such as those used for password resets, making it a widespread threat to OpenAM installations.

Attack Chain

1. The attacker identifies an OpenAM endpoint that uses JATO ViewBeans and contains <jato:form> tags in its JSP (e.g., the password reset page).
2. The attacker crafts a malicious serialized Java object designed to execute arbitrary commands. This payload leverages the PriorityQueue, Column$ColumnComparator, PropertyUtils, TemplatesImpl, and EvilTranslet classes bundled within the OpenAM WAR file.
3. The attacker encodes the malicious serialized object using HTTP Base64 encoding.
4. The attacker sends an HTTP GET or POST request to the vulnerable endpoint, including the Base64-encoded payload as the value of the jato.clientSession parameter.
5. The OpenAM server receives the request and passes the jato.clientSession parameter to RequestContextImpl.getClientSession().
6. During JSP rendering, the <jato:form> tag invokes getClientSession(), which in turn calls hasAttributes(), getEncodedString(), isValid(), and finally ensureAttributes(), triggering deserializeAttributes().
7. The deserializeAttributes() method in ClientSession.java deserializes the jato.clientSession parameter using Encoder.deserialize() and ApplicationObjectInputStream.readObject() without proper input validation.
8. The malicious serialized object is deserialized, leading to the execution of the injected EvilTranslet bytecode and the execution of arbitrary OS commands.

Impact

The pre-authentication nature of this RCE vulnerability allows attackers to compromise OpenAM servers without requiring valid credentials or session tokens. A successful exploit can lead to full server compromise, enabling lateral movement within the network, data exfiltration, and other malicious activities. The vulnerability affects any OpenAM deployment with at least one accessible JATO endpoint whose JSP renders <jato:form> tags. OpenAM 16.0.5 is confirmed to be vulnerable and earlier versions are likely affected.

Recommendation

• Apply WhitelistObjectInputStream filtering to ClientSession.deserializeAttributes() in com/iplanet/jato/ClientSession.java, mirroring the mitigation already in place for ConsoleViewBeanBase.deserializePageAttributes().
• Deploy the Sigma rule "Detect OpenAM JATO ClientSession Deserialization Attempt" to monitor for exploitation attempts targeting the jato.clientSession parameter.
• Audit all callers of Encoder.deserialize() for user-controlled input to identify and mitigate other potential deserialization vulnerabilities.
• As a defense-in-depth measure, consider implementing a JVM-wide JEP 290 deserialization filter to restrict deserialization to trusted classes.