CVE-2017-3203
The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (6.31%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.
- CVSS 3.0
- 8.1 HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 6.31% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-502
- Affected
- pivotal/spring-flex
- Source
- cret@cert.org
References
- http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-executionThird Party Advisory
- https://codewhitesec.blogspot.com/2017/04/amf.htmlExploit, Mitigation, Third Party Advisory
- https://www.kb.cert.org/vuls/id/307983Third Party Advisory, US Government Resource
- https://www.securityfocus.com/bid/97376Third Party Advisory, VDB Entry
- http://www.securityweek.com/flaws-java-amf-libraries-allow-remote-code-executionThird Party Advisory
- https://codewhitesec.blogspot.com/2017/04/amf.htmlExploit, Mitigation, Third Party Advisory
- https://www.kb.cert.org/vuls/id/307983Third Party Advisory, US Government Resource
- https://www.securityfocus.com/bid/97376Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.