ID CVE-2015-7450
Summary Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.
References
Vulnerable Configurations
  • IBM Tivoli Common Reporting 3.1.2.1
    cpe:2.3:a:ibm:tivoli_common_reporting:3.1.2.1
  • IBM Tivoli Common Reporting 3.1.2
    cpe:2.3:a:ibm:tivoli_common_reporting:3.1.2
  • IBM Tivoli Common Reporting 3.1.0.2
    cpe:2.3:a:ibm:tivoli_common_reporting:3.1.0.2
  • IBM Tivoli Common Reporting 3.1.0.1
    cpe:2.3:a:ibm:tivoli_common_reporting:3.1.0.1
  • IBM Tivoli Common Reporting 3.1
    cpe:2.3:a:ibm:tivoli_common_reporting:3.1
  • IBM Tivoli Common Reporting 2.1.1.2
    cpe:2.3:a:ibm:tivoli_common_reporting:2.1.1.2
  • IBM Tivoli Common Reporting 2.1.1
    cpe:2.3:a:ibm:tivoli_common_reporting:2.1.1
  • IBM Tivoli Common Reporting 2.1
    cpe:2.3:a:ibm:tivoli_common_reporting:2.1
CVSS
Base: 10.0 (as of 01-04-2016 - 14:25)
Impact:
Exploitability:
CWE CWE-94
CAPEC
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Manipulating User-Controlled Variables
    This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
exploit-db via4
description IBM WebSphere - RCE Java Deserialization (Metasploit). CVE-2015-7450. Remote exploit for Windows platform. Tags: Metasploit Framework
file exploits/windows/remote/41613.rb
id EDB-ID:41613
last seen 2017-03-15
modified 2017-03-15
platform windows
port 8800
published 2017-03-15
reporter Exploit-DB
source https://www.exploit-db.com/download/41613/
title IBM WebSphere - RCE Java Deserialization (Metasploit)
type remote
metasploit via4
description This module exploits a vulnerability in IBM's WebSphere Application Server. An unsafe deserialization call of unauthenticated Java objects exists to the Apache Commons Collections (ACC) library, which allows remote arbitrary code execution. Authentication is not required in order to exploit this vulnerability.
id MSF:EXPLOIT/WINDOWS/MISC/IBM_WEBSPHERE_JAVA_DESERIALIZE
last seen 2019-01-25
modified 2017-07-24
published 2017-03-13
reliability Excellent
reporter Rapid7
source https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/ibm_websphere_java_deserialize.rb
title IBM WebSphere RCE Java Deserialization Vulnerability
nessus via4
NASL family Web Servers
NASL id WEBSPHERE_JAVA_SERIALIZE.NASL
description The remote IBM WebSphere Application Server is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons Collections (ACC) library. An unauthenticated, remote attacker can exploit this, by sending a crafted SOAP request, to execute arbitrary code on the target host.
last seen 2019-02-21
modified 2018-11-15
plugin id 87171
published 2015-12-02
reporter Tenable
source https://www.tenable.com/plugins/index.php?view=single&id=87171
title IBM WebSphere Java Object Deserialization RCE
packetstorm via4
data source https://packetstormsecurity.com/files/download/141631/ibm_websphere_java_deserialize.rb.txt
id PACKETSTORM:141631
last seen 2017-03-15
published 2017-03-14
reporter Liatsis Fotios
source https://packetstormsecurity.com/files/141631/IBM-WebSphere-Remote-Code-Execution-Java-Deserialization.html
title IBM WebSphere Remote Code Execution Java Deserialization
refmap via4
bid 77653
confirm
exploit-db 41613
sectrack 1035125
saint via4
description IBM WebSphere Management Server Apache Commons
id web_dev_webspherever
title websphere_serialjava
type remote
Last major update 28-11-2016 - 14:43
Published 02-01-2016 - 16:59
Last modified 07-09-2017 - 21:29
Back to Top