OpenEQUELLA - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/openequella/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 22 Sep 2026 22:40:20 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthenticated RCE in openEQUELLA via Deserialization Bypasshttps://feed.craftedsignal.io/briefs/2026-09-openequella-rce/Tue, 22 Sep 2026 22:40:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-openequella-rce/openEQUELLA versions prior to 2026.1.0 contain a critical authenticated remote code execution vulnerability involving insecure Java deserialization via the /invoker/* endpoint.openEQUELLA versions prior to 2026.1.0 are vulnerable to authenticated remote code execution (CVE-2026-67615). The flaw resides in the HTTP invoker endpoint (/invoker/*), which fails to safely handle Java deserialization. Authenticated non-guest users can exploit this by sending a specially crafted serialized object. The implementation uses a PluginAwareObjectInputStream with a class-name denylist; however, attackers bypass this restriction by nesting a malicious payload within a java.security.SignedObject. This wrapping forces the inner stream to be processed by a secondary ObjectInputStream that lacks the required filtering, allowing the payload to reach a JNDI sink. Successful exploitation results in arbitrary code execution within the context of the openEQUELLA service. This vulnerability highlights the risks associated with Java deserialization and the limitations of denylist-based security controls. Organizations using openEQUELLA should upgrade to version 2026.1.0 or later immediately.

Attack Chain

  1. Attacker obtains valid non-guest authenticated access to the target openEQUELLA instance.
  2. Attacker prepares a malicious serialized Java object payload targeting a known JNDI sink.
  3. Attacker wraps the malicious serialized object within a java.security.SignedObject.
  4. Attacker sends an HTTP POST request to the application's /invoker/* endpoint containing the crafted object.
  5. The application endpoint receives the request and triggers the PluginAwareObjectInputStream.
  6. The initial deserialization processes the SignedObject; the embedded inner stream bypasses the class-name denylist filter.
  7. The secondary ObjectInputStream deserializes the nested malicious payload.
  8. The JNDI sink is triggered, leading to arbitrary code execution on the application server.

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary code on the underlying host, potentially leading to full system compromise, data theft, or lateral movement within the environment. This vulnerability affects all deployments of openEQUELLA prior to 2026.1.0. Given the high CVSS score of 8.8, immediate patching is recommended for all affected instances.

Recommendation

  1. Upgrade all openEQUELLA instances to version 2026.1.0 or later to mitigate CVE-2026-67615.
  2. Monitor HTTP invoker traffic to the /invoker/* endpoint for unusual or excessively large serialized object payloads.
  3. Restrict access to the openEQUELLA application to trusted users to reduce the potential for exploitation by malicious or compromised accounts.
]]>highadvisory