{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aopenidentityplatformopenam/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-33439"},{"id":"CVE-2021-35464"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-IBONOK-CVE-2026-33439-POC\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["openam","rce","deserialization"],"_cs_type":"advisory","_cs_vendors":["OpenIdentityPlatform"],"content_html":"\u003cp\u003eOpenIdentityPlatform OpenAM 16.0.5, and likely earlier versions, is susceptible to a critical pre-authentication Remote Code Execution (RCE) vulnerability. This flaw stems from the unsafe Java deserialization of the \u003ccode\u003ejato.clientSession\u003c/code\u003e HTTP parameter. Unlike the patched \u003ccode\u003ejato.pageSession\u003c/code\u003e parameter (CVE-2021-35464), \u003ccode\u003ejato.clientSession\u003c/code\u003e lacks proper input validation, allowing an unauthenticated attacker to inject a malicious serialized Java object. Successful exploitation grants the attacker the ability to execute arbitrary operating system commands with the privileges of the application server user. The vulnerability affects any OpenAM deployment that exposes a JATO endpoint with \u003ccode\u003e\u0026lt;jato:form\u0026gt;\u003c/code\u003e tags in its JSP pages, such as those used for password resets, making it a widespread threat to OpenAM installations.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies an OpenAM endpoint that uses JATO ViewBeans and contains \u003ccode\u003e\u0026lt;jato:form\u0026gt;\u003c/code\u003e tags in its JSP (e.g., the password reset page).\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious serialized Java object designed to execute arbitrary commands. This payload leverages the \u003ccode\u003ePriorityQueue\u003c/code\u003e, \u003ccode\u003eColumn$ColumnComparator\u003c/code\u003e, \u003ccode\u003ePropertyUtils\u003c/code\u003e, \u003ccode\u003eTemplatesImpl\u003c/code\u003e, and \u003ccode\u003eEvilTranslet\u003c/code\u003e classes bundled within the OpenAM WAR file.\u003c/li\u003e\n\u003cli\u003eThe attacker encodes the malicious serialized object using HTTP Base64 encoding.\u003c/li\u003e\n\u003cli\u003eThe attacker sends an HTTP GET or POST request to the vulnerable endpoint, including the Base64-encoded payload as the value of the \u003ccode\u003ejato.clientSession\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eThe OpenAM server receives the request and passes the \u003ccode\u003ejato.clientSession\u003c/code\u003e parameter to \u003ccode\u003eRequestContextImpl.getClientSession()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDuring JSP rendering, the \u003ccode\u003e\u0026lt;jato:form\u0026gt;\u003c/code\u003e tag invokes \u003ccode\u003egetClientSession()\u003c/code\u003e, which in turn calls \u003ccode\u003ehasAttributes()\u003c/code\u003e, \u003ccode\u003egetEncodedString()\u003c/code\u003e, \u003ccode\u003eisValid()\u003c/code\u003e, and finally \u003ccode\u003eensureAttributes()\u003c/code\u003e, triggering \u003ccode\u003edeserializeAttributes()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003edeserializeAttributes()\u003c/code\u003e method in \u003ccode\u003eClientSession.java\u003c/code\u003e deserializes the \u003ccode\u003ejato.clientSession\u003c/code\u003e parameter using \u003ccode\u003eEncoder.deserialize()\u003c/code\u003e and \u003ccode\u003eApplicationObjectInputStream.readObject()\u003c/code\u003e without proper input validation.\u003c/li\u003e\n\u003cli\u003eThe malicious serialized object is deserialized, leading to the execution of the injected \u003ccode\u003eEvilTranslet\u003c/code\u003e bytecode and the execution of arbitrary OS commands.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe pre-authentication nature of this RCE vulnerability allows attackers to compromise OpenAM servers without requiring valid credentials or session tokens. A successful exploit can lead to full server compromise, enabling lateral movement within the network, data exfiltration, and other malicious activities. The vulnerability affects any OpenAM deployment with at least one accessible JATO endpoint whose JSP renders \u003ccode\u003e\u0026lt;jato:form\u0026gt;\u003c/code\u003e tags. OpenAM 16.0.5 is confirmed to be vulnerable and earlier versions are likely affected.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply \u003ccode\u003eWhitelistObjectInputStream\u003c/code\u003e filtering to \u003ccode\u003eClientSession.deserializeAttributes()\u003c/code\u003e in \u003ccode\u003ecom/iplanet/jato/ClientSession.java\u003c/code\u003e, mirroring the mitigation already in place for \u003ccode\u003eConsoleViewBeanBase.deserializePageAttributes()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect OpenAM JATO ClientSession Deserialization Attempt\u0026quot; to monitor for exploitation attempts targeting the \u003ccode\u003ejato.clientSession\u003c/code\u003e parameter.\u003c/li\u003e\n\u003cli\u003eAudit all callers of \u003ccode\u003eEncoder.deserialize()\u003c/code\u003e for user-controlled input to identify and mitigate other potential deserialization vulnerabilities.\u003c/li\u003e\n\u003cli\u003eAs a defense-in-depth measure, consider implementing a JVM-wide JEP 290 deserialization filter to restrict deserialization to trusted classes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T06:46:41Z","date_published":"2024-01-03T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-openam-rce/","summary":"OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the `jato.clientSession` HTTP parameter, allowing unauthenticated attackers to execute arbitrary commands on the server.","title":"OpenAM Pre-Authentication RCE via JATO ClientSession Deserialization","url":"https://feed.craftedsignal.io/briefs/2024-01-openam-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:openidentityplatform:openam:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}