CVE-2021-35464
ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability
Description
CVE-2021-35464 is a CRITICAL remote code execution vulnerability in ForgeRock Access Management (AM) Core Server, carrying a CVSS 3.1 score of 9.8. The vulnerability exists due to Java deserialization in the jato.pageSession parameter on multiple pages, allowing unauthenticated remote code execution by sending a single crafted /ccversion/* request. The flaw originates from the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier. Affected products include ForgeRock Access Management (< 6.5.4) and ForgeRock OpenAM (>= 9.0.0, < 14.6.3). This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2021-11-17. With an EPSS score of 0.94386 (99.97th percentile), this vulnerability demonstrates extremely high real-world exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| forgerock | access management | < 6.5.4 |
| forgerock | openam | >= 9.0.0, < 14.6.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/163486/ForgeRock-OpenAM-Jato-Java-Deserialization.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/163525/ForgeRock-Access-Manager-OpenAM-14.6.3-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://backstage.forgerock.com/knowledge/kb/article/a47894244(Exploit, Permissions Required, Vendor Advisory)
- https://bugster.forgerock.org(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35464(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2021-35464 is classified under CWE-502 — Deserialization of Untrusted Data. This weakness occurs when an application deserializes data from untrusted sources without sufficient verification that the resulting data will be valid and safe. Deserialization of untrusted data can result in arbitrary code execution, denial of service, or other malicious outcomes because the serialized data may contain unexpected object types, manipulated references, or gadget chains that trigger dangerous operations during the deserialization process.
In the context of ForgeRock Access Management, the Java deserialization vulnerability in the jato.pageSession parameter is particularly severe because it affects an identity and access management system that serves as the authentication gateway for enterprise applications. The JATO framework processes serialized Java objects from HTTP request parameters without proper validation, enabling attackers to construct serialized payloads that execute arbitrary code on the server. Since ForgeRock AM handles authentication flows, compromise of this component can provide attackers with the ability to forge authentication tokens and impersonate any user.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2021-35464 carries a CVSS 3.1 score of 9.8 (CRITICAL) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants attackers code execution on the ForgeRock AM server, providing access to authentication databases, session tokens, user credentials, and all data processed by the identity management system. Since ForgeRock AM serves as the authentication gateway, attackers can access secrets for all integrated applications.
Integrity (HIGH): Attackers can execute arbitrary code to modify server configurations, tamper with authentication policies, forge session tokens, and install persistent backdoors. The ability to manipulate the identity provider enables impersonation of any user across all connected applications.
Availability (HIGH): Complete disruption of the authentication service is possible, effectively locking out all users from all applications that depend on ForgeRock AM for authentication. Attackers can crash the service, corrupt data stores, or deploy ransomware.
With an EPSS score of 0.94386 (99.97th percentile), this vulnerability is among the most actively exploited, demanding immediate remediation priority.
Exploit Maturity
CVE-2021-35464 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability has been actively exploited since its disclosure in June 2021. Public exploit code is readily available, including Metasploit modules that automate the exploitation process. The EPSS score of 0.94386 (99.97th percentile) confirms extensive real-world exploitation activity.
Ransomware association: CVE-2021-35464 has been confirmed as associated with ransomware campaigns. The vulnerability's impact on identity and access management systems makes it a high-value target for ransomware operators seeking to compromise enterprise environments.
Attack surface: The vulnerability is triggered through a single HTTP request to /ccversion/* endpoints (Version, Masthead, or ButtonFrame pages). No authentication is required. Multiple public exploit frameworks include modules for this vulnerability, and automated scanning has been widely observed.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2021-11-17.
Remediation
- Apply vendor patches immediately. Update ForgeRock Access Management to version 6.5.4 or later, or ForgeRock OpenAM to version 14.6.3 or later. Consult ForgeRock's security advisory for specific patch guidance.
- Block access to vulnerable endpoints. As an immediate mitigation, block external access to /ccversion/* endpoints (Version, Masthead, ButtonFrame) at the web application firewall or reverse proxy level.
- Identify all ForgeRock AM instances. Inventory all ForgeRock Access Management and OpenAM deployments across your environment, including development, staging, and production instances.
- Investigate for prior compromise. Review web server access logs for requests to /ccversion/* endpoints containing suspicious serialized Java objects. Conduct forensic analysis on servers that may have been exposed.
- Implement Java deserialization protections. Configure Java deserialization filters to restrict allowed classes. Consider deploying runtime application self-protection (RASP) solutions that can detect deserialization attacks.
- Review authentication integrity. After patching, audit all authentication tokens and sessions. Consider forcing re-authentication for all users and rotating all service credentials that may have been exposed.
Technical Details
CVE-2021-35464 is a CRITICAL-severity vulnerability in ForgeRock Access Management that can be exploited remotely over the network. The attack complexity is low, requiring no authentication, no privileges, and no user interaction.
Technical mechanism: The vulnerability exists in the jato.pageSession parameter processed by the Sun ONE Application Framework (JATO), which is used by ForgeRock AM for page session management. When a request is sent to /ccversion/Version, /ccversion/Masthead, or /ccversion/ButtonFrame endpoints, the JATO framework deserializes Java objects from the pageSession parameter without validation. Attackers can craft serialized Java objects containing gadget chains (sequences of Java classes that, when deserialized, trigger arbitrary code execution) to achieve remote code execution. The exploitation requires only a single HTTP request.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects network-based attack, low complexity, no privileges, no user interaction, and maximum CIA impact. The scope is unchanged, meaning exploitation impacts only the ForgeRock AM server.
Affected versions: ForgeRock Access Management before 6.5.4, ForgeRock OpenAM 9.0.0 through 14.6.2.
Frequently Asked Questions
Is CVE-2021-35464 being actively exploited?
Yes, CVE-2021-35464 has been actively exploited since its disclosure in June 2021. It is listed in CISA's KEV catalog with an EPSS score of 0.94386 (99.97th percentile). Public exploit code including Metasploit modules is available, and the vulnerability has been used in ransomware campaigns.
What products are affected by CVE-2021-35464?
ForgeRock Access Management versions before 6.5.4 and ForgeRock OpenAM versions 9.0.0 through 14.6.2 are affected. The vulnerability exists in the JATO framework's handling of the jato.pageSession parameter on /ccversion/* endpoints.
How do I fix CVE-2021-35464?
Update ForgeRock Access Management to version 6.5.4 or later, or OpenAM to version 14.6.3 or later. As an immediate mitigation, block access to /ccversion/* endpoints. Review access logs for exploitation indicators and rotate credentials if compromise is suspected.
How severe is CVE-2021-35464?
CVE-2021-35464 is rated CRITICAL with a CVSS 3.1 score of 9.8. It enables unauthenticated remote code execution via a single HTTP request with no user interaction needed. Its EPSS score of 0.94386 (99.97th percentile) confirms extremely high exploitation rates. It has confirmed ransomware associations.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.