In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So
    Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code
    execution attacks that can be performed by injecting specially crafted serialized objects. And the
    presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in
    Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted
    users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection
    version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version. (CVE-2017-15708)

The remote host is affected by the vulnerability described in GLSA-202107-37 (Apache Commons Collections: Remote code execution)

    Some classes in the Apache Commons Collections functor package       deserialized potentially untrusted input by default.
  Impact :

    Deserializing untrusted input using Apache Commons Collections could       result in remote code execution.
  Workaround :

    There is no known workaround at this time.

All Apache Synapse releases previous to 3.0.1 installed on the remote host are affected by a Remote Code Execution vulnerability. This can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
417333	SCA: security update for org.apache.synapse:synapse-core (GHSA-p694-23q3-rvrc)	Tenable Cloud Security	SCA Checks	critical
417333	SCA: security update for org.apache.synapse:synapse-core (GHSA-p694-23q3-rvrc)	Tenable Self-Hosted Container Security	SCA Checks	critical
156980	GLSA-202107-37 : Apache Commons Collections: Remote code execution	Nessus	Gentoo Local Security Checks	critical
142226	Apache Synapse < 3.0.1 Remote Code Execution Vulnerability	Nessus	Misc.	critical

Detections

Analytics

CVE-2017-15708

critical

Tenable Plugins

critical

critical

critical

critical