Autopass License Server CVE-2024-51768

Risk Priority: HIGH-CRITICAL. Analysis of contributing factors: (1) CVSS 8.0 with AV:A (adjacent network), AC:L (low complexity), PR:L (low privilege), UI:N, and complete confidentiality/integrity/availability impact indicates a serious vulnerability with low exploitation barriers once access is obtained; (2) The requirement for PR:L (low privilege) means any authenticated user or a user with basic network access to APLS can trigger the vulnerability, a realistic threat in enterprise environments; (3) AV:A suggests the attacker must be on the same network segment or have routing access, limiting but not eliminating real-world risk in DMZs, cloud deployments, and multi-tenant environments; (4) CWE-94 (Code Injection) is a well-understood attack class with mature exploitation techniques; (5) HSQLDB deserialization vulnerabilities are documented and exploitable via public PoC tools (e.g., ysoserial). The lack of user interaction (UI:N) and the low complexity mean an automated attack is feasible. SSVC framework assessment: exploitation is PROBABLE (deserialization gadget chains exist in Java), technical impact is TOTAL (RCE), and automatable=YES. Recommendation: Treat as CRITICAL for organizations running APLS <9.17, especially in internet-facing or multi-user environments.

Attack Scenario: An attacker with valid APLS user credentials (or who has enumerated a weak credential through network scanning) connects to an APLS instance via its administrative interface or API endpoint (accessible on port 8080 or 9080 by default). The attacker crafts a malicious Java serialized object using a publicly available gadget chain tool (e.g., ysoserial with commons-collections or spring-core gadgets, if bundled with APLS). This object is embedded in an HSQLDB-compatible request (e.g., via JDBC protocol, SQL injection into serialization contexts, or direct message tampering if HTTPS is not enforced). When APLS deserializes the object, the gadget chain executes arbitrary shell commands with the privileges of the APLS service user (often 'root' or 'SYSTEM' in default installations). The attacker gains a reverse shell, steals license data, implants persistent backdoors, or pivots to adjacent systems. Low complexity (AC:L) and low privilege requirement (PR:L) make this feasible for insider threats or attackers who have compromised a low-privilege account. The adjacent network requirement (AV:A) means the attack is not directly internet-exploitable from outside the corporate network, but is highly viable in cloud environments or shared data center networks.