[FLEX-35290] Deserialization of Untrusted Data via Externalizable.readExternal

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: BlazeDS 4.7.2
• Fix Version/s: Apache BlazeDS 4.7.3
• Component/s: BlazeDS
• Labels: security
• Flags: Important
• Assignee: Christofer Dutz
• Reporter: Markus Wulftange
• Created: 03/Apr/17 09:22
• Updated: 03/Apr/17 14:13
• Resolved: 03/Apr/17 10:33

Description

The AMF deserialization implementation of Flex BlazeDS is vulnerable to Deserialization of Untrusted Data via Externalizable.readExternal(ObjectInput).

By sending a specially crafted AMF message, it is possible to make the server establish a connection to an endpoint specified in the message and request an RMI remote object from that endpoint. This can result in the execution of arbitrary code on the server via Java deserialization.