CVE-2017-15708
CriticalSummary
In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI), allowing remote code execution attacks through specially crafted serialized objects. Versions 3.0.1 and earlier (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) are vulnerable.
Risk Assessment
The lack of authentication for RMI poses a risk of remote code execution, which can lead to serious security breaches within the organization.
Recommendation
It is recommended to restrict RMI access to trusted users only and to upgrade to version 3.0.1, which mitigates the risk associated with Commons Collection version 3.2.1.
Original NVD description (English source)
In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.