CVE-2017-3200 in GraniteDS
Summary
by MITRE
The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this vulnerability depends on the availability of classes in the class path that make use of deserialization. A remote attacker with the ability to spoof or control information may be able to send serialized Java objects with pre-set properties that result in arbitrary code execution when deserialized.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 12/26/2024
The vulnerability described in CVE-2017-3200 represents a critical deserialization flaw within the GraniteDS framework's implementation of Action Message Format version 3 deserialization. This issue specifically affects version 3.1.1.G of the software and demonstrates a dangerous weakness in how serialized Java objects are processed and instantiated. The flaw operates by leveraging the deserialization mechanism to create arbitrary Java classes through their public parameter-less constructors, which then enables subsequent calls to Java Beans setter methods. This particular vulnerability falls under the category of insecure deserialization as defined by CWE-502, where the application deserializes untrusted data without proper validation or sanitization.
The technical exploitation of this vulnerability occurs through the manipulation of serialized AMF3 objects that contain class names and property values. When the GraniteDS framework processes these serialized objects, it automatically instantiates the specified classes and invokes their setter methods with the provided values. The remote attacker can leverage this behavior by crafting malicious serialized objects that reference classes present in the application's classpath, particularly those that exhibit dangerous behaviors when instantiated or when their properties are set. This attack vector is particularly dangerous because it can potentially lead to arbitrary code execution, as the attacker can control both the class instantiation and the values passed to setter methods, which may trigger code execution through various mechanisms such as RMI, JNDI lookups, or other dangerous deserialization patterns.
The operational impact of this vulnerability extends beyond simple remote code execution, as it fundamentally undermines the security model of applications relying on GraniteDS for AMF3 serialization. Attackers can potentially exploit this weakness to gain complete control over affected systems, especially when the target application has classes in its classpath that are susceptible to dangerous instantiation patterns. The vulnerability is particularly concerning because it requires minimal privileges to exploit - simply being able to send serialized data to the application is sufficient for an attacker to attempt exploitation. This characteristic makes the vulnerability particularly attractive to attackers who may have limited access to the system but can still influence data flow through various network-based attack vectors.
The security implications of CVE-2017-3200 align with ATT&CK technique T1203, which describes the use of deserialization vulnerabilities for remote code execution, and specifically relates to the broader category of application layer attacks. Organizations using GraniteDS version 3.1.1.G should consider implementing immediate mitigations including updating to patched versions, implementing strict input validation for serialized objects, and employing additional security controls such as network segmentation to limit exposure. The vulnerability also highlights the importance of proper classpath management and the need to avoid including potentially dangerous classes in applications that process untrusted serialized data, as outlined in various secure coding guidelines and best practices for preventing deserialization attacks.