Deserialization in Apache Flex Blazeds
CVE-2017-5641
Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by default. During the deserialization process code is executed that for several known types has undesired side-effects. Other, unknown types may also exhibit such behaviors. One vector in the Java standard library exists that allows an attacker to trigger possibly further exploitable Java deserialization of untrusted data. Other known vectors in third party libraries can be used to trigger remote code execution.
Vulnerability class: Insecure Deserialization
EPSS: 0.213 (97.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Flex_blazeds
- Apache Software Foundation Flex Blaze Ds — versions before 4.7.3
- Hp Xp_command_view_advanced_edition
Weakness classification (CWE)
Public proof-of-concept exploits
- ARPSyndicate/cve-scores
- ARPSyndicate/cvemon
- AdeliaNitzsche/Java-Deserialization-Cheat-Sheet
- BrittanyKuhn/javascript-tutorial
- GrrrDog/Java-Deserialization-Cheat-Sheet
- PalindromeLabs/Java-Deserialization-CVEs
- klausware/Java-Deserialization-Cheat-Sheet
- lnick2023/nicenice
- mishmashclone/GrrrDog-Java-Deserialization-Cheat-Sheet
- msrb/nvdlib
References
- security@apache.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)
- security@apache.org (vdb-entry, Broken Link, x_refsource_BID)
- security@apache.org (vdb-entry, x_refsource_SECTRACK, Broken Link)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (x_refsource_CONFIRM, Issue Tracking, Vendor Advisory)
- security@apache.org (x_refsource_CONFIRM, Third Party Advisory)
- security@apache.org (VDB Entry, Third Party Advisory, x_refsource_MISC)
- security@apache.org (VDB Entry, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2017-5641?
- CVE-2017-5641 is a critical-severity vulnerability in Apache Flex Blazeds, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2017-12-28.
- How severe is CVE-2017-5641?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2017-5641 known to be exploited?
- 12 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.