CVE-2021-32634 - CVE House

Back to Database

Status published High CVE-2021-32634

Deserialization of Untrusted Data in Emissary

7.2 CVSS

Vulnerability Description

Emissary is a distributed, peer-to-peer, data-driven workflow framework. Emissary 6.4.0 is vulnerable to Unsafe Deserialization of post-authenticated requests to the [`WorkSpaceClientEnqueue.action`](https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/WorkSpaceClientEnqueueAction.java) REST endpoint. This issue may lead to post-auth Remote Code Execution. This issue has been patched in version 6.5.0. As a workaround, one can disable network access to Emissary from untrusted sources.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-32634

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from NationalSecurityAgency

View All →

Emissary Use of a Broken or Risky Cryptographic Algorithm

SkillTree CSRF Vulnerability allows an attacker to modify the Video and Captions of a Skill

Post-authentication Remote Code Execution (RCE) in emissary:emissary

Server-Side Request Forgery (SSRF) in emissary:emissary

Affected Vendor

NationalSecurityAgency

View all reports →

Affected Software

emissary

Vulnerable Versions:

< 6.5.0

Timeline

Official Publish: May 21st, 2021

Last Modified: August 3rd, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1068 Exploitation for Privilege Escalation

Privilege Escalation