Deserialization in Apache Flex Blazeds
CVE-2017-5641
Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by default. During the deserialization process code is executed that for several known types has undesired side-effects. Other, unknown types may also exhibit such behaviors. One vector in the Java standard library exists that allows an attacker to trigger possibly further exploitable Java deserialization of untrusted data. Other known vectors in third party libraries can be used to trigger remote code execution.
Vulnerability class: Insecure Deserialization
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.207 (97.5th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 97.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.207 · newest: 0.207 · change: 0.000
Affected products
- Apache Flex Blazeds
- Apache Software Foundation Flex Blaze Ds — versions before 4.7.3
- HP Xp Command View Advanced Edition
Weakness classification (CWE)
Public proof-of-concept exploits
- ARPSyndicate/cve-scores
- ARPSyndicate/cvemon
- AdeliaNitzsche/Java-Deserialization-Cheat-Sheet
- BrittanyKuhn/javascript-tutorial
- GrrrDog/Java-Deserialization-Cheat-Sheet
- PalindromeLabs/Java-Deserialization-CVEs
- klausware/Java-Deserialization-Cheat-Sheet
- lnick2023/nicenice
- mishmashclone/GrrrDog-Java-Deserialization-Cheat-Sheet
- msrb/nvdlib
References
- www.kb.cert.org/vuls/id/307983 (US Government Resource, Third Party Advisory, third-party-advisory)
- www.securityfocus.com/bid/97383 (vdb-entry, Broken Link)
- www.securitytracker.com/id/1038273 (vdb-entry, Broken Link)
- mail-archives.apache.org/mod_mbox/flex-dev/201703.mbox/<6B86C8D0-6E36-48F5-AC81… (mailing-list)
- issues.apache.org/jira/browse/FLEX-35290 (Issue Tracking, Vendor Advisory)
- support.hpe.com/hpsc/doc/public/display (Third Party Advisory)
- www.zerodayinitiative.com/advisories/ZDI-22-507/ (VDB Entry, Third Party Advisory)
- www.zerodayinitiative.com/advisories/ZDI-22-506/ (VDB Entry, Third Party Advisory)
Frequently asked questions
- What is CVE-2017-5641?
- CVE-2017-5641 is a critical-severity vulnerability in Apache Flex Blazeds, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2017-12-28.
- How severe is CVE-2017-5641?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2017-5641 known to be exploited?
- 12 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.