Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the createCustomCallback function within the AuthXMLUtils.java file. The provided patch edcf968cad91a78b932dba4ad559ef94cbf35f5a clearly shows the modification made to this function to fix the remote code execution vulnerability. The original code used Class.forName(className) to load a class specified in an XML input and then xmlClass.newInstance() to create an object of that class. This allows an unauthenticated attacker to specify an arbitrary class to be loaded and instantiated, leading to remote code execution. The patch mitigates this by first loading the class without initializing it, then checking if it implements the DSAMECallbackInterface, and only then instantiating it. This ensures that only expected classes can be used. The vulnerability description also explicitly mentions AuthXMLUtils.createCustomCallback as the source of the issue.
com.sun.identity.authentication.share.AuthXMLUtils.createCustomCallbackopenam-core/src/main/java/com/sun/identity/authentication/share/AuthXMLUtils.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.openidentityplatform.openam:openam-core | maven | <= 16.1.1 | 16.1.2 |