Description
ForgeRock AM是一个开源的访问管理、权限控制平台。2021年6月29日，国外安全研究人员披露CVE-2021-35464 ForgeRock AM远程代码执行漏洞。攻击者可在无需认证的情况下，通过构造特殊的请求，触发反序列化，从而执行任意代码，接管运行ForgeRock AM服务器。长亭应急响应中心提醒 ForgeRock AM 用户尽快采取安全措施阻止漏洞攻击。
ForgeRock AM ccversion 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://stack.chaitin.com/vuldb/detail/bcafb813-4467-4865-bb7f-eec7c685552e
https://avd.aliyun.com/detail?id=AVD-2021-35464
https://security.zone.ci/aliyun/ali_highrisk/11535.html
https://nosec.org/m/share/4783.html
https://blog.csdn.net/weixin_45728976/article/details/118358052
https://www.exploit-db.com/exploits/50131
https://nvd.nist.gov/vuln/detail/CVE-2021-35464
https://portswigger.net/research/pre-auth-rce-in-forgerock-openam-cve-2021-35464
https://www.rapid7.com/blog/post/2021/06/30/forgerock-openam-pre-auth-remote-code-execution-vulnerability-what-you-need-to-know/
https://www.aliyun.com/notice/113102
https://backstage.forgerock.com/knowledge/kb/article/a47894244
https://github.com/Y4er/openam-CVE-2021-35464
https://www.huaweicloud.com/intl/zh-cn/notice/20210630173251489.html
https://www.anquanke.com/post/id/247357
https://www.cyber.gov.au/about-us/advisories/advisory-2021-004-active-exploitation-forgerock-access-manager-openam-servers