CyberRota Analysis
AI-GeneratedOpenAM versions prior to 16.1.1 are vulnerable to a deserialization flaw in the handling of anonymous Push Notification SNS callbacks, allowing low-privileged users to manipulate message IDs and trigger class loading in the Java Virtual Machine. This could lead to classpath-dependent process execution, file writes, or denial of service, posing a significant risk to system integrity. Organizations using affected versions should prioritize upgrading to 16.1.1 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the anonymous Push Notification SNS callback handled by SnsMessageResource falls back to a CTS predicate blob after a messageId expires from the in-memory dispatcher, treats top-level blob keys as Java class names for Class.forName, and deserializes attacker-controlled JSON through Jackson. A low-privileged user who starts Push Registration and obtains the messageId, shared secret, and challenge can wait for expiry, replace the persistent blob through anonymous callbacks, and trigger class loading and construction in the OpenAM JVM. The primitive can cause classpath-dependent process execution, file writes, or denial of service, although command execution was not confirmed on the tested stock classpath. This issue is fixed in version 16.1.1.