Summary
OpenAM versions before 16.1.3 contain an unauthenticated arbitrary class instantiation flaw in the legacy JAX-RPC SOAP interface. A remote attacker may submit crafted requests without a valid authenticated session to load selected classes, potentially causing denial of service, exposing classpath details, or reaching code execution through suitable gadget chains.
Affected context
The vulnerability occurs in OpenAM deployments where the legacy JAX-RPC SOAP interface remains reachable at /jaxrpc/* and does not adequately authenticate or verify session identifiers before processing class-loading requests. Risk is higher when the interface is exposed to untrusted networks and when the runtime classpath contains classes that can be abused for harmful side effects.
Exploit preconditions
- Attack surface: The legacy JAX-RPC SOAP endpoint under
/jaxrpc/* - Required access: Network access to the SOAP interface; a valid authenticated account may not be required
- Trigger point: Processing a SOAP request containing an attacker-selected class name and an unverified session identifier
- Why exploitation is possible: The interface performs security-sensitive class instantiation before establishing sufficient authentication and authorization
Why this happens
The underlying flaw is a missing authentication check around a critical class-loading operation. Requests reaching the legacy SOAP interface can influence which application classes are instantiated even when the associated session identifier has not been adequately verified. This maps to CWE-306: Missing Authentication for Critical Function, because an unauthenticated caller can invoke functionality that should be restricted. The behavior also reflects an unsafe dynamic class-loading pattern that can broaden the impact beyond the intended service operation.
Potential impact
- An attacker may crash the OpenAM server or cause repeated service disruption
- An attacker could probe available classes and reveal implementation details
- Unauthorized class initialization may alter application behavior
- Carefully selected runtime conditions could enable code execution through gadget chains
- Compromised services may expose connected identity or authentication infrastructure
General mitigation guidance
Mitigation generally focuses on removing or isolating legacy SOAP functionality and ensuring that every security-sensitive operation is authenticated and authorized before processing attacker-controlled parameters.
Common defensive patterns include:
- Disabling unused JAX-RPC endpoints and restricting access to required trusted networks
- Enforcing strong authentication and authorization before any class-loading or session-sensitive operation
- Replacing dynamic class instantiation with allowlisted, fixed operation mappings
- Validating session identifiers through a centralized, fail-closed security boundary
- Running OpenAM with least privilege and limiting access to downstream identity services
- Reducing unnecessary classes and gadget-capable libraries from production runtimes where feasible
How teams detect issues like this
Organizations can look for:
- Static-analysis findings involving reflection, dynamic class loading, or class instantiation based on request data
- Code-review signals showing authentication checks performed after dispatch or object construction
- SOAP traffic directed at
/jaxrpc/*, especially requests with invalid, missing, or inconsistent session identifiers - Repeated class-loading errors, unexpected server crashes, and anomalous initialization activity in application logs
- Network policies that prevent untrusted clients from reaching legacy management or SOAP interfaces
- Automated application-security and API-security tools that test authentication enforcement and input-controlled dispatch paths
