CVE-2020-12133
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on affected systems by exploiting Java deserialization in the javax.faces.ViewState parameter. It affects Apros Evolution, ConsciusMap, and Furukawa provisioning systems. Attackers can gain full control of vulnerable systems without authentication.
💻 Affected Systems
- Apros Evolution
- ConsciusMap
- Furukawa provisioning systems
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining root/admin privileges, deploying ransomware, stealing sensitive data, and pivoting to other network systems.
Likely Case
Remote code execution leading to data theft, installation of backdoors, or deployment of cryptocurrency miners on vulnerable systems.
If Mitigated
Limited impact with proper network segmentation and security controls, potentially only affecting isolated systems.
🎯 Exploit Status
Public exploit code available on Packet Storm Security. Attack requires sending specially crafted HTTP requests with malicious serialized Java objects.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2.8.1
Vendor Advisory: https://www.furukawa.co.jp
Restart Required: Yes
Instructions:
1. Contact vendor for updated versions beyond 2.8.1. 2. Apply vendor-provided patches. 3. Restart affected services. 4. Verify patch application.
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall or filter to block malicious javax.faces.ViewState parameters
Configure WAF rules to inspect and block suspicious ViewState parameters
Implement input validation in web.xml
Network Segmentation
allIsolate vulnerable systems from internet and restrict internal access
Configure firewall rules to limit access to affected systems
Implement network segmentation
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure to trusted IPs only
- Deploy web application firewall with rules to detect and block Java deserialization attacks
🔍 How to Verify
Check if Vulnerable:
Check system version against affected versions (2.8.1 and earlier). Test with proof-of-concept exploit if authorized.Check Version:
Check application version in web interface or configuration files specific to each productVerify Fix Applied:
Verify version is updated beyond 2.8.1. Test with known exploit payloads to confirm they are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual Java deserialization errors in logs
- Large or malformed javax.faces.ViewState parameters in HTTP requests
- Unexpected Java process execution
Network Indicators:
- HTTP requests with unusually large ViewState parameters
- Patterns matching Java serialization payloads
- Outbound connections from affected systems to unknown IPs
SIEM Query:
source="web_logs" AND (http_uri CONTAINS "javax.faces.ViewState" AND http_param_size > 10000) OR (error_message CONTAINS "java.io.InvalidClassException")🔗 References
- http://packetstormsecurity.com/files/157383/Furukawa-Electric-ConsciusMAP-2.8.1-Java-Deserialization-Remote-Code-Execution.html
- https://www.furukawa.co.jp
- https://www.tecnoredsa.com.ar
- http://packetstormsecurity.com/files/157383/Furukawa-Electric-ConsciusMAP-2.8.1-Java-Deserialization-Remote-Code-Execution.html
- https://www.furukawa.co.jp
- https://www.tecnoredsa.com.ar
