GraniteDS 3.1.1.G AMF3 Deserializer Serialized Java Object deserialization

Summaryinfo

A vulnerability, which was classified as critical, has been found in GraniteDS 3.1.1.G. The affected element is an unknown function of the component AMF3 Deserializer. This manipulation as part of Serialized Java Object causes deserialization. This vulnerability appears as CVE-2017-3200. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as critical was found in GraniteDS 3.1.1.G. Affected by this vulnerability is an unknown functionality of the component AMF3 Deserializer. The manipulation as part of a Serialized Java Object leads to a deserialization vulnerability. The CWE definition for the vulnerability is CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this vulnerability depends on the availability of classes in the class path that make use of deserialization. A remote attacker with the ability to spoof or control information may be able to send serialized Java objects with pre-set properties that result in arbitrary code execution when deserialized.

The bug was discovered 04/04/2017. The weakness was presented 06/11/2018 by Markus Wulftange as confirmed advisory (CERT.org). It is possible to read the advisory at kb.cert.org. This vulnerability is known as CVE-2017-3200 since 12/05/2016. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 433 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 97382†). See VDB-99550, VDB-119322, VDB-119324 and VDB-119325 for similar entries. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• GraniteDS

Version

• 3.1.1.G

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion