OpenAM Push Notification Deserialization Flaw

Executive Summary

This vulnerability in OpenAM involves unsafe Java deserialization through push notifications. An attacker can exploit it by starting Push Registration, obtaining a messageId and shared secret, waiting for the messageId to expire, and then replacing a persistent blob via anonymous callbacks. This triggers class loading and deserialization of attacker-controlled JSON, potentially leading to process execution, file writes, or denial of service.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your OpenAM instance is running a version prior to 16.1.1. Verify the version by examining the OpenAM server logs or running commands like 'curl -s http://<openam-server>/openam/version' or checking the installed package version via 'dpkg -l | grep openam' or 'rpm -qa | grep openam'.

Useful 0 Not Useful 0

Impact Analysis

The impact includes potential remote code execution, unauthorized file writes, or denial of service depending on the OpenAM deployment's classpath. An attacker with low privileges can trigger these effects by exploiting the deserialization flaw through crafted push notification callbacks.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenAM to version 16.1.1 or later to address the vulnerability. Disable anonymous access to the Push Notification SNS callback endpoint if possible. Review and restrict access to the Core Token Service (CTS) to prevent unauthorized modifications to stored predicate blobs.

Useful 0 Not Useful 0