CVE-2017-15708 Remote Code Execution in Apache Synapse
CriticalCVSS 9.8
EPSS 17.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.synapse/synapse-core(Maven) | < 3.0.1 | 3.0.1 |
| org.apache.synapse/synapse-core(Maven) | = 1.0 | No fix listed |
| org.apache.synapse/synapse-core(Maven) | = 1.1 | No fix listed |
| org.apache.synapse/synapse-core(Maven) | = 1.1.1 | No fix listed |
| org.apache.synapse/synapse-core(Maven) | = 1.1.2 | No fix listed |
| org.apache.synapse/synapse-core(Maven) | = 1.2 | No fix listed |
| org.apache.synapse/synapse-core(Maven) | = 2.0.0 | No fix listed |
| org.apache.synapse/synapse-core(Maven) | = 2.1.0 | No fix listed |
| org.apache.synapse/synapse-core(Maven) | = 3.0.0 | No fix listed |
| apache synapse | = 1.0 | No fix listed |
| apache synapse | = 1.1 | No fix listed |
| apache synapse | = 1.1.1 | No fix listed |
| apache synapse | = 1.1.2 | No fix listed |
| apache synapse | = 1.2 | No fix listed |
| apache synapse | = 2.0.0 | No fix listed |
| apache synapse | = 2.1.0 | No fix listed |
| apache synapse | = 3.0.0 | No fix listed |
| oracle financial services market risk measurement and management | = 8.0.6 | No fix listed |
| oracle financial services market risk measurement and management | = 8.0.8 | No fix listed |
| oracle PeopleSoft Enterprise PeopleTools | = 8.56 | No fix listed |
| oracle PeopleSoft Enterprise PeopleTools | = 8.57 | No fix listed |
| Apache Synapse | = 3.0.0 | No fix listed |
| Apache Synapse | = 2.1.0 | No fix listed |
| Apache Synapse | = 2.0.0 | No fix listed |
| Apache Synapse | = 1.2 | No fix listed |
Show 2 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Synapse | = 1.1.2 | No fix listed |
| Apache Synapse | = 1.1.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- lists.apache.org
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- 102154 third-party-advisory vdb-entry
- lists.apache.org
- GLSA-202107-37 third-party-advisory vendor-advisory
- github.com
- [dev] 20171210 [CVE-2017-15708] Apache Synapse Remote Code Execution Vulnerability mailing-list
- [doris-commits] 20210402 [GitHub] [incubator-doris] zh0122 opened a new pull request #5595: [FE][Fix]Update commons-collections to fix a security issue mailing-list