Flex BlazeDS AMF Deserialization RCE - Vulnerability Database

Flex BlazeDS AMF Deserialization RCE

Description

The web application uses Apache Flex BlazeDS with a vulnerable Action Message Format (AMF) deserialization implementation. BlazeDS is a server-side Java remoting and messaging technology that uses AMF to serialize and deserialize data. When processing untrusted AMF data, the application fails to properly validate object types during deserialization, allowing attackers to instantiate arbitrary Java classes and execute malicious code on the server.

Remediation

Take the following steps to remediate this vulnerability:

1. Upgrade BlazeDS immediately:
Update to Apache Flex BlazeDS version 4.7.3 or later, which addresses CVE-2017-5641. Download the latest version from the official Apache Flex project repository.

2. Implement deserialization controls:
If immediate patching is not possible, implement class whitelisting to restrict which classes can be deserialized. Configure the ClassDeserializationValidator in your BlazeDS configuration:

<validators>
  <validator class="flex.messaging.validators.ClassDeserializationValidator">
    <properties>
      <allow-classes>
        <class name="com.example.safe.Class1"/>
        <class name="com.example.safe.Class2"/>
      </allow-classes>
    </properties>
  </validator>
</validators>

3. Network segmentation:
Restrict access to BlazeDS endpoints using firewall rules or web application firewall (WAF) policies to limit exposure to trusted clients only.

4. Verify the fix:
After upgrading, perform security testing to confirm the vulnerability has been resolved and no regression issues exist.