/
← Voltar ao feed
critical exploit público

Pre-auth RCE in OpenAM via jato.clientSession unsafe deserialization (CVE-2026-33439)

1 fonte(s) · 1 atualização(ões) · publicado 06/04/2026 21:00 · coletado há 1 dia

Hacktron AI researchers disclosed CVE-2026-33439 (CVSS 9.8, CWE-502), an unauthenticated remote code execution flaw in OpenIdentityPlatform OpenAM 16.0.5 and earlier. It is a variant of CVE-2021-35464: the earlier fix whitelisted deserialization for the jato.pageSession parameter but left the sibling jato.clientSession parameter unfiltered. A single unauthenticated GET request to a password reset page is enough to achieve code execution. The article does not report in-the-wild exploitation, but the researchers describe the exploit path in detail while withholding their custom gadget chain. The issue is fixed in OpenAM 16.0.6.

Technical Details

  • jato.clientSession is passed to Encoder.deserialize(), which calls ApplicationObjectInputStream.readObject() with no whitelist or class restrictions, unlike IOUtils.deserialise(), which uses WhitelistObjectInputStream.
  • Deserialization fires only when the rendered JSP contains <jato:form> tags. The unauthenticated /openam/ui/PWResetUserValidation and /ui/PWResetQuestion pages qualify.
  • The request must not also include jato.pageSession, otherwise dispatchRequest() throws a ServletException before JSP rendering.
  • The gadget chain is a Click-style chain: PriorityQueue → Column$ColumnComparator → PropertyUtils → TemplatesImpl.getOutputProperties() (xalan-2.7.3) → attacker bytecode → Runtime.exec. Click classes are repackaged under org.openidentityplatform.openam.click.control, so the stock ysoserial Click1 chain needs adapting.
  • The payload is URL-safe Base64 encoded and sent in the jato.clientSession query parameter.
  • Tested on OpenAM 16.0.5 with Tomcat 10.1.52 and Java 21.0.7, and on the official Docker image with Java 25.

Remediation

  • Upgrade to OpenAM 16.0.6 or later, which routes Encoder.deserialize() through IOUtils.deserialise() with the same whitelist as jato.pageSession, and adds StackWalker-based tracing of deserialization callers.
  • Until patched, restrict external access to the OpenAM password reset endpoints and monitor for requests carrying a jato.clientSession parameter.

Exploit público

Há código de exploração publicado no Exploit-DB para CVE-2021-35464. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.

  1. exploit-db.com · EDB-50131 ↗ · aplicação web · java · pub. 16/07/2021 não verificado

    ForgeRock Access Manager 14.6.3 - Remote Code Execution (RCE) (Unauthenticated)

    This exploit abuses unsafe Java deserialization in a version-information page of ForgeRock Access Manager/OpenAM that is reachable without login. The attacker only needs network access to a vulnerable install (OpenAM 14.6.3, AM 6.x up to 6.5.3, fixed in AM 7); no credentials or user interaction. A prebuilt gadget chain makes the server run operating system commands and return the output. It is a working tool that finds the endpoint, confirms the flaw with a harmless test, then runs a chosen command.

    CVE-2021-35464 · autor: Photubias · explicação gerada por IA

Linha do tempo

  1. hacktron.ai ↗ · pub. 06/04/2026 21:00 · coletado 19/10 18:03 primeiro registro

    Pre-auth RCE in OpenAM via jato.clientSession unsafe deserialization (CVE-2026-33439)

    ler a análise desta fonte

    Hacktron AI researchers disclosed CVE-2026-33439 (CVSS 9.8, CWE-502), an unauthenticated remote code execution flaw in OpenIdentityPlatform OpenAM 16.0.5 and earlier. It is a variant of CVE-2021-35464: the earlier fix whitelisted deserialization for the jato.pageSession parameter but left the sibling jato.clientSession parameter unfiltered. A single unauthenticated GET request to a password reset page is enough to achieve code execution. The article does not report in-the-wild exploitation, but the researchers describe the exploit path in detail while withholding their custom gadget chain. The issue is fixed in OpenAM 16.0.6.

    Technical Details

    • jato.clientSession is passed to Encoder.deserialize(), which calls ApplicationObjectInputStream.readObject() with no whitelist or class restrictions, unlike IOUtils.deserialise(), which uses WhitelistObjectInputStream.
    • Deserialization fires only when the rendered JSP contains <jato:form> tags. The unauthenticated /openam/ui/PWResetUserValidation and /ui/PWResetQuestion pages qualify.
    • The request must not also include jato.pageSession, otherwise dispatchRequest() throws a ServletException before JSP rendering.
    • The gadget chain is a Click-style chain: PriorityQueue → Column$ColumnComparator → PropertyUtils → TemplatesImpl.getOutputProperties() (xalan-2.7.3) → attacker bytecode → Runtime.exec. Click classes are repackaged under org.openidentityplatform.openam.click.control, so the stock ysoserial Click1 chain needs adapting.
    • The payload is URL-safe Base64 encoded and sent in the jato.clientSession query parameter.
    • Tested on OpenAM 16.0.5 with Tomcat 10.1.52 and Java 21.0.7, and on the official Docker image with Java 25.

    Remediation

    • Upgrade to OpenAM 16.0.6 or later, which routes Encoder.deserialize() through IOUtils.deserialise() with the same whitelist as jato.pageSession, and adds StackWalker-based tracing of deserialization callers.
    • Until patched, restrict external access to the OpenAM password reset endpoints and monitor for requests carrying a jato.clientSession parameter.