CVE-2021-35464: ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability

Vulnerability summary

CVE-2021-35464 is a high (CVSS 10.0) Deserialization of Untrusted Data vulnerability in ForgeRock Access Management (AM). It is known to be exploited: CISA lists it, first on 03-11-2021. It has been used in ransomware campaigns. EPSS estimates a 100.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 5 public exploits are recorded.

Timeline

1. 22-07-2021
   PublishedVulnerability first disclosed.
2. 03-11-2021
   Added to CISA KEVForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability
3. 17-11-2021
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier

• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.