TLDR Tech / InfoSec
Almost Impossible: Java Deserialization Through Broken Crypto in OpenText Directory Services
Searchlight Cyber (Assetnote) discovered an unauthenticated Java deserialization vulnerability in OpenText Directory Services (OTDS) exploitable in its default configuration, stemming from a flawed HMAC signature verification where attacker-controlled length fields allowed truncating the signed message to begin at an injected payload. Exploitation required building a custom Deflate compressor with tailored Huffman codes to produce output restricted to valid modified UTF-8 bytes (0x01-0x7F) while remaining incompressible by zlib, enabling the payload to survive a double-compression pipeline intact. Organizations running OTDS should patch immediately, as a compromise could affect all integrated OpenText applications that rely on it for authentication.
Read the full story