ForgeRock AM远程代码执行漏洞（CVE-2021-35464）

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464
• https://nvd.nist.gov/vuln/detail/CVE-2021-35464
• https://www.rapid7.com/blog/post/2021/06/30/forgerock-openam-pre-auth-remote-code-execution-vulnerability-what-you-need-to-know/
• https://www.sentinelone.com/vulnerability-database/cve-2021-35464/
• https://www.exploit-db.com/exploits/50131
• https://www.invicti.com/web-application-vulnerabilities/forgerock-am-openam-deserialization-rce-cve-2021-35464
• https://www.cve.org/CVERecord?id=CVE-2021-35464
• https://backstage.forgerock.com/knowledge/kb/article/a47894244
• https://github.com/Y4er/openam-CVE-2021-35464
• https://attackerkb.com/topics/KnAX5kffui/pre-auth-rce-in-forgerock-openam-cve-2021-35464

Related Vulnerabilities

• PoCCVE-2026-33439: OpenAM <= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization
• PoCCVE-2021-29156: LDAP Injection In OpenAM
• PoCCVE-2021-35464: ForgeRock OpenAM <7.0 - Remote Code Execution
• PoCCVE-2024-41667: OpenAM<=15.0.3 FreeMarker - Template Injection
• OpenIdentityPlatform OpenAM 需授权 代码注入漏洞
• ForgeRock AM ccversion 远程代码执行漏洞
• ForgeRock AM远程代码执行漏洞(CVE-2021-35464)