CVE-2017-5641: Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by default. During the…

PriorityP268critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

21.27%

97.3th percentile

Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by default. During the deserialization process code is executed that for several known types has undesired side-effects. Other, unknown types may also exhibit such behaviors. One vector in the Java standard library exists that allows an attacker to trigger possibly further exploitable Java deserialization of untrusted data. Other known vectors in third party libraries can be used to trigger remote code execution.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apache	flex_blazeds	<= 4.7.2	—
apache_software_foundation	apache_flex_blaze_ds	—	—
hp	xp_command_view_advanced_edition	< 8.5.3-00	8.5.3-00

Detection & IOCsextracted from sources · hover to see the quote

path/daip/messagebroker/amf↗

otherContent-Type: application/x-amf↗

commandsun.rmi.server.UnicastRef↗

→Flag any AMF POST body containing the plaintext string 'sun.rmi.server.UnicastRef' as a strong indicator of CVE-2017-5641 exploitation attempt leveraging the Java RMI deserialization gadget chain. ↗

·The vulnerable endpoint path (/daip/messagebroker/amf) is application-specific; the canonical BlazeDS AMF endpoint pattern is /messagebroker/amf — defenders should enumerate all deployed AMF servlet mappings rather than relying on a single path. ↗
·The PoC only demonstrates the UnicastRef (Java stdlib) gadget chain; the NVD advisory notes that third-party library gadget chains enabling full RCE also exist and are not covered by this single payload signature. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.