| Package | Affected versions | Patched versions |
|---|---|---|
| org.openidentityplatform.openam:openam | < 16.0.6 | 16.0.6 |
| openam | < 16.0.6 | 16.0.6 |
OpenIdentityPlatform OpenAM 16.0.5 (and likely earlier versions) is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464.
An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains <jato:form> tags (e.g., the Password Reset pages).
CVE-2021-35464 identified that the jato.pageSession HTTP parameter was deserialized without class filtering, allowing pre-auth RCE.
OpenIdentityPlatform OpenAM mitigated this by introducing WhitelistObjectInputStream in ConsoleViewBeanBase.deserializePageAttributes(), which restricts jato.pageSession deserialization to a hardcoded whitelist of ~40 safe classes.
However, the JATO framework contains a second deserialization entry point — jato.clientSession — handled by ClientSession.deserializeAttributes(). This code path was not patched and still uses the unfiltered Encoder.deserialize() → ApplicationObjectInputStream, which performs ObjectInputStream.readObject() with no class whitelist.
ClientSession.deserializeAttributes()
→ Encoder.deserialize()
→ ApplicationObjectInputStream.readObject() // VULNERABLE — no whitelist
The ClientSession object is instantiated in RequestContextImpl.getClientSession() with the raw jato.clientSession parameter value from the HTTP request. Deserialization is triggered during JSP rendering when <jato:form> tags invoke getClientSession() → hasAttributes() → getEncodedString() → isValid() → ensureAttributes() → deserializeAttributes().
File: com/iplanet/jato/ClientSession.java
protected ClientSession(RequestContext context) {
this.encodedSessionString =
context.getRequest().getParameter("jato.clientSession");
}
protected void deserializeAttributes() {
if (this.encodedSessionString != null
&& this.encodedSessionString.trim().length() > 0) {
this.setAttributes(
(Map) Encoder.deserialize(
Encoder.decodeHttp64(this.encodedSessionString), false)
);
}
}
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeThe exploit uses classes bundled in the OpenAM WAR:
PriorityQueue.readObject() [java.util — JDK]
→ heapify() → siftDown() → comparator.compare()
→ Column$ColumnComparator.compare() [openam-core-16.0.5.jar]
→ Column.getProperty()
→ PropertyUtils.getObjectPropertyValue() [openam-core-16.0.5.jar]
→ Method.invoke(TemplatesImpl, "getOutputProperties")
→ TemplatesImpl.getOutputProperties() [xalan-2.7.3.jar]
→ newTransformer() → defineTransletClasses()
→ TransletClassLoader.defineClass(_bytecodes)
→ _class[_transletIndex].newInstance()
→ EvilTranslet.<clinit>() [attacker bytecode]
→ Runtime.getRuntime().exec(cmd)
<jato:form> tags (e.g., Password Reset pages)openidentityplatform/openam:latest Docker image (Java 25)ClientSession.deserializeAttributes() unpatchedWhitelistObjectInputStream filtering to ClientSession.deserializeAttributes(), matching the mitigation already applied to ConsoleViewBeanBase.deserializePageAttributes()Encoder.deserialize() for user-controlled inputThis finding was discovered by Rahul Maini and Hacktron AI while auditing OpenIdentityPlatform OpenAM. Hacktron AI is our white-box pentest solution, designed to deliver high-accuracy results with minimal false positives.
This bug is subject to a 90-day disclosure deadline. If a fix for this issue is made available to users before the end of the 90-day deadline, this bug report will become public on the day that the fix was made available or an earlier or later date if agreed by both parties. Otherwise, this bug report will become public at the deadline.
If another researcher discloses the proof-of-concept before any deadlines, we reserve the right to publish our findings.
The details of this bug may be privately disclosed to vulnerable parties, including but not limited to Hacktron AI's customers.