Pre-auth RCE in ForgeRock AM via JATO jato.pageSession deserialization

This repository contains a single Metasploit module targeting CVE-2021-35464, a pre-authentication remote code execution vulnerability in ForgeRock OpenAM and the ForgeRock Identity Platform. The exploit leverages a Java deserialization flaw in the Jato framework, allowing attackers to execute arbitrary commands or drop a Meterpreter payload on the target system by sending a specially crafted POST request to the '/openam/oauth2/..;/ccversion/Version' endpoint. The module supports both Unix command execution and Linux dropper payloads, making it highly weaponized and flexible. The code is written in Ruby and follows the standard Metasploit module structure, including auto-check capabilities and payload staging. The only file in the repository is the exploit module itself, which is fully operational and ready for use within the Metasploit framework.

This repository is an exploit for CVE-2021-35464, a pre-authentication remote code execution vulnerability in ForgeRock OpenAM. The exploit is based on ysoserial and Java-Rce-Echo, and leverages Java deserialization to inject a memory shell into Tomcat, enabling arbitrary command execution via HTTP requests. The main exploit logic is in the Java files under src/ysoserial/payloads, particularly Click1.java (which constructs a malicious serialized object) and TomcatEchoInject.java (which implements the memory shell). The entry point is src/com/test/Main.java, which demonstrates generating the payload. The README provides a detailed example of the HTTP POST request required to trigger the vulnerability, targeting the /OpenAM/ccversion/Version endpoint. The exploit requires the attacker to send a crafted serialized object to the vulnerable endpoint, after which commands can be executed on the server by including a 'cmd' header in subsequent requests. The repository is operational and provides a working exploit for the vulnerability, but does not include a fully weaponized, automated attack tool.