# [HTAF4-213] [Pre-submission] Unsafe AMF deserialization (CVE-2017-5641) in Apache Flex BlazeDS at the https://www.███████/daip/messagebroker/amf

DoD BlazeDS AMF endpoint deserializes untrusted AMF, letting a crafted sun.rmi.server.UnicastRef payload trigger server-side DNS/RMI callbacks.

- Payout: hidden
- Severity: critical
- Program: U.S. Dept Of Defense
- Found by: sp1d3rs
- Disclosed: 2024-06-18
- CVE: CVE-2017-5641
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/728614
- Library page: https://bugbountylibrary.com/r/h1%3A728614
- Tags: area:web domain:web impact:rce kind:bounty platform:hackerone sev:critical tech:java technique:oob-exfil technique:source-review vuln:deserialization vuln:rce

**Target:** Apache Flex BlazeDS AMF message broker endpoint (/daip/messagebroker/amf)
**Root cause:** BlazeDS deserializes attacker-controlled AMF data without a class allowlist, permitting instantiation of arbitrary Java classes such as sun.rmi.server.UnicastRef.
**Steps:**
1. Send a baseline POST to `/daip/messagebroker/amf` with `Content-Type: application/x-amf` and a collaborator host in the body; observe no callback (rules out simple reflection).
2. Craft an AMF payload embedding `sun.rmi.server.UnicastRef` with the collaborator IP/port packed as the RMI endpoint.
3. POST the serialized AMF payload to the endpoint.
4. Observe significant delay and an inbound DNS/RMI callback from the backend server, confirming deserialization.
**How found:** Spotted the BlazeDS `messagebroker/amf` endpoint and tested whether it deserialized AMF; used a two-step control (plain host in body vs. host inside serialized UnicastRef) to distinguish reflection from actual deserialization-triggered callback.
**Exploitation:** Attacker submits a serialized AMF body containing a UnicastRef gadget pointing at an attacker-controlled host; the server deserializes it and performs an outbound RMI/DNS lookup, proving code-path reachability for further gadget-chain exploitation.
**Insight:** When testing deserialization sinks, prove the trigger with a control request: put the callback host in the raw body first (no hit), then embed it inside a known gadget class like sun.rmi.server.UnicastRef so only deserialization can cause the callback.