CVE-2021-35464

What it actually does

This is an unauthenticated Java deserialization flaw in ForgeRock Access Management (AM) prior to version 7.0. The vulnerable JATO page-session handling logic deserializes attacker-controlled data supplied in the jato.pageSession parameter on /ccversion/* pages. Because the endpoint is reachable over the network without authentication and deserialization occurs before trust is established, a crafted request can cause arbitrary Java gadget execution in the AM server process, leading to remote code execution with the privileges of the application server account. The CVSS 9.8 score reflects network reachability, no required credentials, no user interaction, and full confidentiality, integrity, and availability impact.

Why it matters to the business

Successful exploitation can give an external attacker control of an identity and access management server, which is a high-value system because it commonly brokers authentication, sessions, tokens, and access to other applications. Compromise can result in service outage, credential or token theft, creation of unauthorized access paths, lateral movement into dependent systems, and ransomware deployment. This vulnerability is in CISA KEV, has been exploited in the wild, is associated with ransomware activity, has an EPSS probability of 0.99999, and had a CISA remediation due date of 2021-11-17, so any remaining exposure should be treated as urgent legacy risk.

How an attack unfolds

An attacker scans for internet-facing or otherwise reachable ForgeRock AM deployments and identifies the /ccversion/ endpoint. The attacker sends a specially crafted HTTP request containing a malicious jato.pageSession value. The vulnerable server deserializes that value using Java/JATO page-session logic before authentication is required. If a usable gadget chain is present in the application classpath, deserialization invokes attacker-controlled code inside the AM application server process. The attacker then typically establishes command execution, deploys a web shell or in-memory implant, harvests configuration secrets or tokens, modifies identity-provider behavior, pivots to connected systems, or deploys ransomware. Because public exploitation has existed for years and the issue is cataloged in KEV, opportunistic scanning and post-compromise activity should be assumed when vulnerable systems have been exposed.

How to fix it

Upgrade ForgeRock AM to version 7.0 or later, or to the vendor-supported fixed release for the deployed AM branch. If immediate upgrade is not possible, restrict external and untrusted access to AM administrative and legacy endpoints, block requests to /ccversion/* where operationally safe, filter requests containing jato.pageSession at the edge, and isolate the AM service from unnecessary outbound network access. Rotate sensitive AM secrets, signing/encryption keys, OAuth/OIDC client secrets, and administrative credentials if exposure or compromise is suspected. Review any advisory-feed package mappings carefully: the supplied fixed package records list webkit2gtk and wpewebkit package versions, including Debian fixed versions 2.34.1-1 or 2.34.1-1~deb11u1 and Ubuntu 20.04 LTS fixed version 2.34.1-0ubuntu0.20.04.1; validate whether those package records apply to separate downstream advisories rather than the ForgeRock AM server vulnerability described here.

How to confirm the fix worked

Confirm the deployed ForgeRock AM version is 7.0 or later, or that the relevant vendor patch for the installed branch has been applied. Verify that unauthenticated requests to /ccversion/* are no longer accepted or no longer process jato.pageSession input. Use package and application inventory rather than banner data alone, because reverse proxies and custom deployments may hide the true AM version. Review web server, reverse proxy, WAF, load balancer, and application access logs for historical /ccversion/ requests containing jato.pageSession. After patching or mitigation, run an authenticated configuration review and a safe unauthenticated exposure check from an external vantage point to ensure the endpoint is not reachable or vulnerable. If any suspicious requests are found, treat the system as potentially compromised and perform incident response rather than only patch validation.

Typical attack path

1. Identify a reachable ForgeRock AM service, commonly by scanning web login, OpenAM, or access-management endpoints.
2. Probe for /ccversion/ paths and confirm the application responds to unauthenticated requests.
3. Send a crafted request to a /ccversion/* page with an attacker-controlled jato.pageSession parameter.
4. Trigger unsafe Java deserialization in the AM/JATO server-side page-session handler.
5. Achieve command execution in the application server context.
6. Perform post-exploitation actions such as dropping a web shell, running shell commands, reading AM configuration and secrets, stealing tokens or credentials, creating persistence, moving laterally, or deploying ransomware.

How to detect it

Review reverse proxy, load balancer, WAF, web server, and application server access logs for requests to /ccversion/ endpoints, especially those containing the jato.pageSession parameter. Focus on unauthenticated requests, unusual user agents, URL-encoded or very long parameter values, base64-like payloads, HTTP 500 responses followed by successful 200 responses, and repeated probes from the same source. Inspect ForgeRock AM debug logs, servlet container logs such as catalina.out and localhost_access_log, and Java exception logs for deserialization errors, JATO page-session handling errors, class-loading errors, or process execution anomalies around the time of suspicious requests. On hosts, review EDR/process telemetry for child processes spawned by the Java/Tomcat/WebLogic/JBoss application server process, such as sh, bash, dash, cmd, powershell, curl, wget, python, perl, nc, or openssl. Look for newly written JSP files, modified web application directories, unexpected cron/systemd entries, outbound connections from the AM server to unfamiliar IPs, credential and token access, and changes to AM configuration or identity-provider settings. Because this vulnerability has been actively exploited and associated with ransomware activity, suspicious historical hits should trigger full incident response, secret rotation, and downstream identity audit.

• /ccversion/
• /openam/ccversion/
• /ccversion/Version
• jato.pageSession
• jato.pageSession=
• /ccversion/Version?jato.pageSession=
• GET /openam/ccversion/
• POST /openam/ccversion/
• GET /ccversion/
• POST /ccversion/
• java.io.ObjectInputStream
• java.io.InvalidClassException
• java.io.StreamCorruptedException
• java.io.OptionalDataException
• java.lang.ClassNotFoundException
• com.iplanet.jato
• com.sun.identity
• catalina.out
• localhost_access_log
• /openam/debug/
• /debug/
• /webapps/openam/
• /webapps/openam/*.jsp
• /var/lib/tomcat
• /opt/tomcat
• /opt/openam

What your security team should do

• Immediately inventory all ForgeRock AM/OpenAM deployments, including internet-facing, partner-facing, and internal identity services.
• Prioritize emergency remediation for any ForgeRock AM version earlier than 7.0, especially systems reachable from the internet or untrusted networks.
• Because this issue is in CISA KEV, has ransomware association, and has extremely high EPSS, assume exposed vulnerable systems may have been targeted and perform retrospective compromise assessment.
• Search historical HTTP logs for /ccversion/ and jato.pageSession activity before and after the patch date.
• If exploitation is suspected, preserve application server logs, access logs, AM debug logs, filesystem artifacts, memory where possible, and recent process/network telemetry before rebuilding or patching.
• Rotate AM administrative credentials, OAuth/OIDC/SAML secrets, signing keys, encryption keys, service-account credentials, and any secrets stored on or accessible from the AM server if compromise cannot be ruled out.
• Harden network exposure by placing AM behind trusted ingress controls, WAF rules, and administrative access restrictions; block legacy endpoints that are not required.
• Review downstream systems that trust AM-issued tokens or assertions for anomalous logins, unexpected privilege changes, and token abuse.
• Add SIEM detections for requests containing both /ccversion/ and jato.pageSession, and alert on command-execution behavior from the Java application server process.
• Validate advisory-feed product mappings before closing remediation tasks, because the provided affected package list includes webkit2gtk/wpewebkit records that do not match the ForgeRock AM vulnerability description.