Headline

CVE-2021-33207: advisories/2021/CVE-2021-33207 at master · blackarrowsec/advisories

The HTTP client in MashZone NextGen through 10.7 GA deserializes untrusted data when it gets an HTTP response with a 570 status code.

3 years ago

CVE

Open in Source

#vulnerability #git #java

CVE-2021-33207: Remote Code Execution (Java Deserialization)

Vendor: Software AG
Vendor URL: https://www.softwareag.com/corporate/products/az/mashzone_nextgen/default
Versions affected: MashZone NextGen 10.7 GA | Build 1607 (Vendor did not provide data about other affected versions)
Discovered by: Marcos Díaz
Public fix: No
Proof of Concept: No

Summary

MashZone NextGen 10.7 GA | Build 1607 and likely other/older versions, are affected by an insecure Java Object deserialization.

Details

The method errorResponse from the class com.idsscheer.ppmmashup.io.util.ZHttpRequestHelper performs an insecure Java deserialization from the body of a special crafted HTTP answer.

Impact

Command execution can be achieved forcing the application to make a HTTP request to a server controlled by an attacker.

Recommendation

Make sure you have changed the default administrative credentials. At this point we do not have information about a fix from Software AG.

Timeline