CVE-2020-4464
published 2020-07-17CVE-2020-4464: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with a…
PriorityP262high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
13.23%
95.9th percentile
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with a specially-crafted sequence of serialized objects over the SOAP connector. IBM X-Force ID: 181489.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | 7.0.0.0 – 7.0.0.45 | — |
| ibm | websphere_application_server | 8.0.0.0 – 8.0.0.15 | — |
| ibm | websphere_application_server | 8.5.0.0 – 8.5.5.17 | — |
| ibm | websphere_application_server | 9.0.0.0 – 9.0.5.4 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect SOAP requests to the wsadmin SOAP connector containing a token string of 'TokenBasedfoo' (or any 'TokenBased' prefixed value) in the authentication header — this is the auth-bypass string used to reach the deserialization code path. ↗
- →Monitor for SOAP requests that reach GenericSerializer.unmarshall() without a properly authenticated Subject — the vulnerability allows unauthenticated callers to trigger arbitrary Java object deserialization via the SOAP connector. ↗
- →Alert on SOAP requests to the IBM WebSphere wsadmin SOAP endpoint that include serialized Java objects embedded directly in the request body — this is the known attack vector for this CVE. ↗
- →The attack targets the SOAP connector of IBM WebSphere Application Server (versions 7.0, 8.0, 8.5, 9.0 traditional); monitor for unexpected or unauthenticated inbound connections to the SOAP connector port carrying serialized object payloads. ↗
- ·The authentication bypass relies on token-based authentication being in use on the wsadmin SOAP endpoint; environments not using token-based authentication may present a different attack surface. ↗
- ·IBM Java SDK mitigations make gadget chain exploitation non-trivial; a specific bypass gadget was required and is not publicly detailed in these sources. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Trendmicro
Exploiting Other Remote Protocols in IBM WebSphere
blogs_trendmicro·2020-09-29·CVSS 8.8
[HIGH] Exploiting Other Remote Protocols in IBM WebSphere
## Exploiting Other Remote Protocols in IBM WebSphere
Learn how to exploit other remote protocols in IBM WebSphere.
By: Zero Day Initiative Sep 29, 2020 Read time: ( words)
Save to Folio
In a recent blog post , we disclosed how a vulnerability in the Internet InterORB Protocol (IIOP) protocol of IBM WebSphere can result in remote code execution. In this blog post, we explore how two additional protocols supported by this application server can also be leveraged to achieve the same result. The first is a logic flaw in the authentication mechanism of the wsadmin SOAP endpoint submitted by the researcher known as tint0 ( ZDI-20-878 ), and the second is a vulnerability in a protocol used for WebSphere Extended Deployment reported by b0yd ( ZDI-20-688 )
CVE-2020-4464: SOAP Deserialization
Trendmicro
Exploiting Other Remote Protocols in IBM WebSphere
blogs_trendmicro·2020-09-29·CVSS 8.8
[HIGH] Exploiting Other Remote Protocols in IBM WebSphere
## Exploiting Other Remote Protocols in IBM WebSphere
Learn how to exploit other remote protocols in IBM WebSphere.
By: Zero Day Initiative 2020/09/29 Read time: ( words)
Save to Folio
In a recent blog post , we disclosed how a vulnerability in the Internet InterORB Protocol (IIOP) protocol of IBM WebSphere can result in remote code execution. In this blog post, we explore how two additional protocols supported by this application server can also be leveraged to achieve the same result. The first is a logic flaw in the authentication mechanism of the wsadmin SOAP endpoint submitted by the researcher known as tint0 ( ZDI-20-878 ), and the second is a vulnerability in a protocol used for WebSphere Extended Deployment reported by b0yd ( ZDI-20-688 )
CVE-2020-4464: SOAP Deserialization of
Trendmicro
Exploiting Other Remote Protocols in IBM WebSphere
blogs_trendmicro·2020-09-29·CVSS 8.8
[HIGH] Exploiting Other Remote Protocols in IBM WebSphere
# Exploiting Other Remote Protocols in IBM WebSphere
Learn how to exploit other remote protocols in IBM WebSphere.
By: Zero Day Initiative
2020/09/29
Read time: ( words)
Save to Folio
In a recent blog post, we disclosed how a vulnerability in the Internet InterORB Protocol (IIOP) protocol of IBM WebSphere can result in remote code execution. In this blog post, we explore how two additional protocols supported by this application server can also be leveraged to achieve the same result. The first is a logic flaw in the authentication mechanism of the wsadmin SOAP endpoint submitted by the researcher known as tint0 (ZDI-20-878), and the second is a vulnerability in a protocol used for WebSphere Extended Deployment reported by b0yd (ZDI-20-688)
CVE-2020-4464: SOAP Deserialization of Untr
https://exchange.xforce.ibmcloud.com/vulnerabilities/181489https://www.ibm.com/support/pages/node/6250059https://www.zerodayinitiative.com/advisories/ZDI-20-878/https://exchange.xforce.ibmcloud.com/vulnerabilities/181489https://www.ibm.com/support/pages/node/6250059https://www.zerodayinitiative.com/advisories/ZDI-20-878/
2020-07-17
Published