Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Apache Synapse allows unauthorized code execution via remote access

CVE-2017-15708 · published 8 years ago
Summary

Apache Synapse, a software used for integrating applications, has a security flaw that allows attackers to execute code remotely without a password. This affects all versions of Synapse up to 3.0.1, but upgrading to 3.0.1 will fix the issue. To protect your system, consider limiting who can access Synapse remotely or upgrading to the latest version.

What to do
  • Update apache org.apache.synapse:synapse-core to version 3.0.1.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.synapse:synapse-core < 3.0.1
Fix: upgrade to 3.0.1
– apache synapse 1.0
1.1
1.1.1
1.1.2
1.2
2.0.0
2.1.0
3.0.0
cpe:2.3:a:apache:synapse:1.0:*:*:*:*:*:*:*
– oracle financial_services_market_risk_measurement_and_management 8.0.6
8.0.8
cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*
– oracle peoplesoft_enterprise_peopletools 8.56
8.57
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*
Original advisory text
In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows...
In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
18% chance of attack within 30 days
Type
CWE-74Injection
CWE-502Deserialization of Untrusted Data
Timeline
Published11 Dec 2017
Updated7 Oct 2026
First seen6 Mar 2026
Sources
GHSA-p694-23q3-rvrc · GHSA
CVE-2017-15708 · NVD
Track software like this
Free during beta