GitHub Advisoryadvisory · Maven

GHSA-p694-23q3-rvrc Remote Code Execution in Apache Synapse

CRITICAL Published 2020-11-04 Modified 2022-03-18 Official page ↗
Aliases
CVE-2017-15708
Ecosystem
Maven
Packages
org.apache.synapse:synapse-core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502, CWE-74
Reviewed
2020-11-04

Affected packages

• Maven org.apache.synapse:synapse-core: < 3.0.1 → fixed in 3.0.1

Description

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.

Related

Alias · CVE (1)

  • CVE-2017-15708 In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). vulnerability

Weakness · CWE (2)

  • CWE-502 Deserialization of Untrusted Data weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References