Attack Chain

1. The attacker identifies an OpenAM endpoint that uses JATO ViewBeans and contains <jato:form> tags in its JSP (e.g., the password reset page).
2. The attacker crafts a malicious serialized Java object designed to execute arbitrary commands. This payload leverages the PriorityQueue, Column$ColumnComparator, PropertyUtils, TemplatesImpl, and EvilTranslet classes bundled within the OpenAM WAR file.
3. The attacker encodes the malicious serialized object using HTTP Base64 encoding.
4. The attacker sends an HTTP GET or POST request to the vulnerable endpoint, including the Base64-encoded payload as the value of the jato.clientSession parameter.
5. The OpenAM server receives the request and passes the jato.clientSession parameter to RequestContextImpl.getClientSession().
6. During JSP rendering, the <jato:form> tag invokes getClientSession(), which in turn calls hasAttributes(), getEncodedString(), isValid(), and finally ensureAttributes(), triggering deserializeAttributes().
7. The deserializeAttributes() method in ClientSession.java deserializes the jato.clientSession parameter using Encoder.deserialize() and ApplicationObjectInputStream.readObject() without proper input validation.
8. The malicious serialized object is deserialized, leading to the execution of the injected EvilTranslet bytecode and the execution of arbitrary OS commands.

Impact

The pre-authentication nature of this RCE vulnerability allows attackers to compromise OpenAM servers without requiring valid credentials or session tokens. A successful exploit can lead to full server compromise, enabling lateral movement within the network, data exfiltration, and other malicious activities. The vulnerability affects any OpenAM deployment with at least one accessible JATO endpoint whose JSP renders <jato:form> tags. OpenAM 16.0.5 is confirmed to be vulnerable and earlier versions are likely affected.

Recommendation

• Apply WhitelistObjectInputStream filtering to ClientSession.deserializeAttributes() in com/iplanet/jato/ClientSession.java, mirroring the mitigation already in place for ConsoleViewBeanBase.deserializePageAttributes().
• Deploy the Sigma rule "Detect OpenAM JATO ClientSession Deserialization Attempt" to monitor for exploitation attempts targeting the jato.clientSession parameter.
• Audit all callers of Encoder.deserialize() for user-controlled input to identify and mitigate other potential deserialization vulnerabilities.
• As a defense-in-depth measure, consider implementing a JVM-wide JEP 290 deserialization filter to restrict deserialization to trusted classes.