Vulnerability Note VU#307983
Action Message Format (AMF3) Java implementations are vulnerable to insecure deserialization and XML external entities references
Original Release date: 04 Apr 2017 | Last revised: 14 Apr 2017

Overview
Several Java implementations of AMF3 are vulnerable to insecure deserialization and XML external entities references.

Description
Several Java implementations of Action Message Format (AMF3) are vulnerable to one or more of the following implementation errors:
CWE-502: Deserialization of Untrusted Data

Some Java implementations of AMF3 deserializers derive class instances from java.io.Externalizable rather than the AMF3 specification’s recommendation of flash.utils.IExternalizable.

A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.

The reporter has identified the following products and versions as being affected, and CVE ID have been assigned as follows:
– Atlassian JIRA, versions from 4.2.4 prior to version6.3.0 – CVE-2017-5983
– Flamingo amf-serializer by Exadel, version 2.2.0 – CVE-2017-3201
– GraniteDS, version 3.1.1.GA – CVE-2017-3199
– Pivotal/Spring spring-flex – CVE-2017-3203
– WebORB for Java by Midnight Coders, version 5.1.1.0 – CVE-2017-3207

Products using these libraries may also be impacted.

CWE-913: Improper Control of Dynamically-Managed Code Resources

Some Java implementations of AMF3 deserializers may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods.

The ability to exploit this vulnerability depends on the availability of classes in the class path that make use of deserialization.

A remote attacker with the ability to spoof or control information may be able to send serialized Java objects with pre-set properties that result in arbitrary code execution when deserialized.

The reporter has identified the following products and versions as being affected, and CVE ID have been assigned as follows:
– Flamingo amf-serializer by Exadel, version 2.2.0 – CVE-2017-3202
– Flex BlazeDS , versions 4.6.0.23207 and 4.7.2 – CVE-2017-5641
– GraniteDS, version 3.1.1.GA – CVE-2017-3200

Products using these libraries may also be impacted.

CWE-611: Improper Restriction of XML External Entity Reference (‘XXE’)

Some Java implementations of AMF3 deserializers allow external entity references (XXEs) from XML documents embedded within AMF3 messages.
If the XML parsing is handled incorrectly it could potentially expose sensitive data on the server, denial of service, or server side request forgery.

– Flamingo amf-serializer by Exadel, version 2.2.0 – CVE-2017-3206
– Flex BlazeDS , version 4.6.0.23207 – CVE-2015-3269
– GraniteDS, version 3.1.1.GA – CVE-2016-2340 (see VU#279472)
– WebORB for Java by Midnight Coders, version 5.1.1.0 – CVE-2017-3208

Products using these libraries may also be impacted.

More information is provided in the researcher’s advisory.

Impact
A remote attacker with the ability to spoof or control a server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.

Solution
Apply an update if available

CERT/CC recommends applying an update or patch to your product if available.
Some vendors have responded that only out-of-support versions of products are impacted.
In these cases, CERT/CC recommends updating your product to the latest supported version.

More details are included for each vendor in the vendor records below.
Developers should use an updated JDK

Developers should use an updated Java development kit (JDK). JDK 8 update 121, JDK 7 update 131 and JDK 6 update 141 implement basic serialization blacklisting filters, while more serialization protection measures are expected in the upcoming Java 9.

For more information, please see JEP 290.

Developers should be suspicious of deserialized data from untrusted sources

Developers should in general be very suspicious of deserialized data from an untrusted source.

For best practices, see the CERT Oracle Coding Standard for Java guidelines for Serialization, especially rules SER12-J and SER13-J.

Use firewall rules or filesystem restrictions

System administrators may be able to mitigate this issue for some applications by restricting access to the network and/or filesystem.
If an affected application utilizes an open port accepting serialized objects, restricting access to the application may help mitigate the issue.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedAdobeAffected28 Mar 201703 Apr 2017
Apache Software FoundationAffected28 Mar 201707 Apr 2017
AtlassianAffected-07 Apr 2017
VMwareAffected16 Mar 201714 Apr 2017
ExadelUnknown28 Mar 201728 Mar 2017
Granite Data ServicesUnknown16 Mar 201716 Mar 2017
Hewlett Packard EnterpriseUnknown28 Mar 201728 Mar 2017
Midnight CodersUnknown16 Mar 201703 Apr 2017
PivotalUnknown28 Mar 201728 Mar 2017
SonicWallUnknown28 Mar 201728 Mar 2017If you are a vendor and your product is affected, let
us know.

CVSS Metrics (Learn More)

Group
Score
Vector

Base
9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C

Temporal
8.4
E:POC/RL:U/RC:C

Environmental
6.3
CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

http://codewhitesec.blogspot.com/2017/04/amf.html
http://openjdk.java.net/jeps/290
http://www.kb.cert.org/vuls/id/279472
http://www.adobe.com/go/amfspec
https://cwe.mitre.org/data/definitions/502.html
https://cwe.mitre.org/data/definitions/913.html
https://cwe.mitre.org/data/definitions/611.html

Credit

Thanks to Markus Wulftange for reporting this vulnerability.
This document was written by Garret Wassermann.

Other Information

CVE IDs:
CVE-2015-3269
CVE-2016-2340
CVE-2017-5641
CVE-2017-5983
CVE-2017-3199
CVE-2017-3200
CVE-2017-3201
CVE-2017-3202
CVE-2017-3203
CVE-2017-3206
CVE-2017-3207
CVE-2017-3208

Date Public:
04 Apr 2017

Date First Published:
04 Apr 2017

Date Last Updated:
14 Apr 2017

Document Revision:
89

FeedbackIf you have feedback, comments, or additional information about this vulnerability, please send us email.

Leave a Reply