Affected versions: TIBCO Data Virtualization 8.3 and belowīy sending an HTTP POST request with random data to /monitor/messagebroker/amf, the server will respond with a 200 OK and binary data that includes:.CWE-502: Deserialization of Untrusted Data.Vulnerability Details #1: Unsafe Flex AMF Java Object Deserialization More details are in the Disclosure Process section.Ī video of the exploit in action can be seen here. I attempted to disclose these vulnerabilities responsibly to TIBCO, but they refused to acknowledge my vulnerability report. A Ruby exploit which abuses this vulnerability chain was released with this advisory. This vulnerability chain affects all versions of TDV up to 8.3 and below, and it is exploitable on Linux and Windows hosts. By abusing this deserialization and combining it with an outdated Java library that contains a gadget chain, it is possible to achieve remote code execution as root on Linux or SYSTEM on Windows. TDV exposes an unauthenticated Action Message Format (AMF) API endpoint that is vulnerable to insecure Java deserialization. Interaction with the software is done over a Web interface on port 9400. TIBCO Data Virtualization (TDV) is a product for data processing and analytics which can be installed onto Linux and Windows hosts. TDV connects to virtually any data source and provides business users access to data through JDBC, ODBC, ADO.NET, REST and SOAP. TIBCO® Data Virtualization (TDV) allows you to easily create logical views to integrate and secure data across disparate data sources and tailor it to your analytical needs. TIBCO® Data Virtualization integrates disparate data sources in real-time instead of copying their data into a data warehouse. #1: Unsafe Flex AMF Java Object Deserialization.Multiple vulnerabilities in TIBCO Data Virtualization (versions 8.3 and below) By Pedro Ribeiro ( | from Agile Information Security Disclosure: / Last updated:

Tibco data virtualization pricing