CVE-2017-15708 — Remote Code Execution in Apache Synapse

Description

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Synapse	3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1	—

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

HuSoul/CVE-2017-15708 ★ 0 · Dec 18, 2017

Apache synapse 反序列化 CVE–2017–15708

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.synapse:synapse-core	< 3.0.1	3.0.1	GHSA-p694-23q3-rvrc

Advisories 1

WID-SEC-2022-1738 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2025

Remote Code Execution in Apache Synapse