CVE-2021-35464: ForgeRock Access Management RCE Flaw

CVE-2021-35464 Overview

CVE-2021-35464 is a critical Java deserialization vulnerability affecting ForgeRock Access Management (AM) server versions before 7.0. The vulnerability exists in the jato.pageSession parameter on multiple pages and allows unauthenticated remote code execution through a single crafted request to the /ccversion/* endpoint. This flaw originates from the usage of the Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier.

Critical Impact

This vulnerability enables unauthenticated attackers to achieve complete remote code execution on vulnerable ForgeRock AM servers with a single HTTP request. CISA has added this vulnerability to its Known Exploited Vulnerabilities Catalog, indicating active exploitation in the wild.

Affected Products

• ForgeRock Access Management (versions before 7.0)
• ForgeRock OpenAM (all versions using vulnerable JATO framework)

Discovery Timeline

• 2021-07-22 - CVE-2021-35464 published to NVD
• 2025-11-05 - Last updated in NVD database

Technical Details for CVE-2021-35464

Vulnerability Analysis

This insecure deserialization vulnerability (CWE-502) allows attackers to execute arbitrary code on vulnerable ForgeRock AM servers without any authentication. The flaw resides in how the server processes the jato.pageSession parameter, which accepts serialized Java objects. When a maliciously crafted serialized object is sent to the server, it is deserialized without proper validation, leading to arbitrary code execution in the context of the application server.

The vulnerability is particularly dangerous because it requires no authentication and can be triggered through a single HTTP request. Attackers can exploit this by sending a crafted payload to endpoints matching the /ccversion/* URL pattern. The underlying cause is the reliance on the legacy Sun ONE Application Framework (JATO), which was designed for Java 8 and earlier versions and contains unsafe deserialization practices.

Root Cause

The root cause of CVE-2021-35464 is the use of the deprecated Sun ONE Application Framework (JATO) within ForgeRock AM. JATO was designed for older Java versions and implements insecure deserialization of the jato.pageSession parameter without proper input validation or type checking. This framework automatically deserializes user-supplied data, allowing attackers to inject malicious serialized Java objects that execute arbitrary commands when processed by the server.

Attack Vector

The attack vector for CVE-2021-35464 is network-based and requires no authentication or user interaction. An attacker can craft a malicious HTTP request containing a serialized Java object payload in the jato.pageSession parameter. When sent to vulnerable /ccversion/* endpoints, the ForgeRock AM server automatically deserializes the payload, triggering the execution of attacker-controlled code.

The exploitation chain typically involves:

1. Identifying a publicly accessible ForgeRock AM server
2. Crafting a serialized Java object containing a malicious payload using known gadget chains
3. Sending the payload to vulnerable endpoints via the jato.pageSession parameter
4. Achieving remote code execution with the privileges of the application server

Technical details and proof-of-concept exploits are available through Packet Storm's ForgeRock OpenAM Jato Java Deserialization PoC and Packet Storm's ForgeRock Access Manager RCE.

Detection Methods for CVE-2021-35464

Indicators of Compromise

• Unusual HTTP requests to /ccversion/* endpoints containing large or encoded jato.pageSession parameters
• Unexpected process spawning from the ForgeRock AM Java process (e.g., shell processes, cmd.exe, bash)
• Web server logs showing POST requests with suspicious serialized Java object signatures in parameters
• Anomalous outbound network connections from the ForgeRock AM server to unknown external hosts

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block serialized Java objects in HTTP parameters
• Monitor for HTTP requests containing Java serialization magic bytes (AC ED 00 05 or Base64-encoded equivalents) in the jato.pageSession parameter
• Deploy endpoint detection and response (EDR) solutions to identify abnormal process execution chains originating from the AM server
• Configure intrusion detection systems (IDS) with signatures for known ForgeRock deserialization exploit patterns

Monitoring Recommendations

• Enable detailed access logging for all ForgeRock AM endpoints, particularly /ccversion/* paths
• Implement real-time alerting for any requests containing the jato.pageSession parameter with encoded or binary content
• Monitor Java process behavior for signs of post-exploitation activity such as file system modifications or credential access
• Establish baseline network behavior for ForgeRock AM servers and alert on deviations

How to Mitigate CVE-2021-35464

Immediate Actions Required

• Upgrade ForgeRock Access Management to version 7.0 or later immediately
• If immediate patching is not possible, restrict network access to ForgeRock AM servers to trusted networks only
• Block external access to /ccversion/* endpoints at the network perimeter or web application firewall
• Review server logs for evidence of exploitation attempts and potential compromises

Patch Information

ForgeRock has released patches addressing this vulnerability. Organizations should upgrade to ForgeRock Access Management version 7.0 or later, which removes the vulnerable JATO framework dependencies. For detailed patching guidance, refer to the ForgeRock Knowledge Base Article.

Workarounds

• Implement network segmentation to restrict access to ForgeRock AM servers from untrusted networks
• Configure reverse proxy or WAF rules to block requests containing jato.pageSession parameters with serialized content
• Disable or restrict access to /ccversion/* endpoints if they are not required for business operations
• Monitor and alert on any access attempts to vulnerable endpoints while awaiting patch deployment

# Example: Block vulnerable endpoints at nginx reverse proxy
location ~ ^/ccversion/ {
    deny all;
    return 403;
}

# Example: iptables rule to restrict AM server access
iptables -A INPUT -p tcp --dport 8443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP