OpenAM jato.clientSession pre-auth deserialization RCE

OpenAM jato.clientSession pre-auth deserialization RCE (CVE-2026-33439)

Source and API bundle

OpenIdentityPlatform OpenAM <= 16.0.5 (fixed 16.0.6) — cve.now month ranking entry.

Eden terminates the HTTP connection to the affected product, evaluates a declarative policy and — in tier 2 — a separately compiled native Rust module under signed module authority, before any byte reaches the application. This removes the delivery primitive from the network path. It does not patch the affected OpenAM instance; the vendor's fixed release remains the durable repair.

Status: live two-tier remediation recorded 2026-11-11 on the installed eden-product-release:1.103.0-single lab container (image sha256:809293e1f0b525ac04698d1fa8d7ffdc66cbee1ff690b082ba26b4d050f08416).

The vulnerability

OpenAM's JATO ViewBean endpoints deserialize the jato.clientSession HTTP parameter without the whitelist applied to jato.pageSession after CVE-2021-35464, giving unauthenticated remote code execution on reachable pages (e.g. Password Reset). Exploit public, Nuclei template available.

The fleet challenge for this class is unchanged from the portfolio: the durable fix is the vendor's patched release, but fleets contain appliances and long-lived deployments that cannot upgrade inside an exploitation window (KEV-listed, public tooling). Eden's boundary removes the delivery primitive from the network path immediately, at a separately compiled enforcement point, without touching the application host.

The Eden patch

Tier 1 — declarative policy (blunt, fail-closed): deny on /openam/UI POST descendants — takes every JATO form offline, including ordinary logins.

Tier 2 — native module (surgical): gabriel_openamdeser_v1 refuses requests whose jato.clientSession= parameter carries the serialized-Java magic marker (rO0AB, base64 of 0xACED0005); ordinary form posts — including ordinary clientSession values — pass unchanged.

Module gabriel_openamdeser_v1, binary SHA-256 89021ccf7b18d6a589836ede179fe1ac58941b0eec288152790ef855cba46588 (source f4d07b08f41dcf52806fcc70b15d2a27bc4d6dcfec82b81241e77b9ff86c3d6a), keys the serialized-Java marker in jato.clientSession values.

Measured comparison (live, 2026-11-11)

Every tier-2 refusal was measured against the same probe's live unprotected baseline; benign rows document tier-1's false positives and tier-2's zero.

Performance trace (Eden telemetry, live 2026-11-11)

Measured with Eden's built-in request telemetry (gateway.request.baseline spans, read back through /api/v1/analytics/telemetry?signal=traces), not client wall-clock. Latency Eden introduces per remediation arm for this case:

Eden-added latency for the tier-2 remediation: benign requests complete in 457 µs mean (p50 428 µs, p95 609 µs) in-product, module evaluation included. Honest scope: lab fixtures on one host, fresh connection per measured request, warm requests only; module reactivated shards 2/2 with a fresh signed statement per measurement; spans carry the full authority lineage (module SHA-256, operation, publication). Not the EDEN-3640 performance qualification contract.

Tested against: eden-product-release:1.103.0-single (image sha256:809293e1f0b525ac…, build target eden_service_single, tooling revision 81a0724a…). Raw data: module2/telemetry-ab/openamdeser-telemetry.json and module2/tier1-ab/openamdeser-tier1.json.

Authority lifecycle and negatives

Reached the serving process only through the full signed lifecycle (module2/evidence/openamdeser-module.json): enroll_key (Ed25519 public key), independent-host inventory, inspect (bindings derived without mapping code), host approve, signed admit (prepared, serving_now: false), activate — receipt serving_now: true, applied_shards == expected_shards (2/2). Negatives held: read-only inspect -> 403, tampered statement binding -> 400, flipped signature bit -> 403. revoke made the interlay fail closed (503, nothing forwarded, zero backend effects) and a fresh host approval plus a newly signed activation restored surgical protection.

Honest scope

The fixture replicates the delivery shape and exploit prerequisite with harmless marker effects; no real OpenAM runs here. Other deserialization sinks (jato.pageSession is whitelisted upstream), non-JATO routes and off-boundary traffic are out of scope; gadget-class diversity inside the marker is not classified — the marker itself is the delivery primitive and is refused. Modules are lab-grade rules for the fixture delivery shapes, not production OpenAM patches. Perf: the request-path A/B was not re-run for this batch (see README); activation telemetry measured ~0.14 s one-time load.

Cost record (per-CVE ledger)

0.0256 USD (marginal session growth over this case's window: 366,308 input + 20 output tokens across 1 assistant turns; windows can overlap where debugging was shared).

Evidence appendix

• cve.now entry
• Raw evidence: gabriel-2026-11-11/module2/evidence/openamdeser-module.json
• Deployment: installed eden-product-release:1.103.0-single lab container (image sha256:809293e1f0b525ac04698d1fa8d7ffdc66cbee1ff690b082ba26b4d050f08416)
• Skill: eden-vulnerability-remediation

Decision flow

The source checks a particular serialized-Java marker after the selected parameter. The diagram does not represent a general deserialization validator.

Complete native module source

The complete available source for gabriel_openamdeser_v1 is reproduced below from the reviewed repository snapshot. The source SHA-256 is f4d07b08f41dcf52806fcc70b15d2a27bc4d6dcfec82b81241e77b9ff86c3d6a. This identifies the source bytes, rather than independently proving the binary build or the recorded test results. The case’s experiment status and limitations still apply, including any failed import, partial coverage, or withdrawn claim. Original source comments are preserved verbatim.

//! Gabriel module: refuse serialized-Java gadget payloads in the OpenAM
//! jato.clientSession parameter (CVE-2026-33439 shape).
//!
//! CVE-2026-33439: OpenAM's JATO ViewBean endpoints deserialize the
//! jato.clientSession HTTP parameter without the whitelist applied to
//! jato.pageSession, giving pre-authentication RCE. This module refuses
//! requests on the JATO surface whose jato.clientSession parameter carries
//! the serialized-Java marker (base64 of the 0xACED0005 magic, `rO0AB`);
//! ordinary form posts — including ordinary jato.clientSession values — pass
//! unchanged. no_std.

#![no_std]

use core::mem::size_of;
use core::panic::PanicInfo;
use eden_gateway_remediation::message::{Availability, MessageInput};
use eden_gateway_remediation::module::{
    ApiHeader, CONTINUE, Decision, EDIT, EditSink, Edits, Failure, ModuleOutput, NEED_MORE, REFUSE, RemediationModule,
};
use eden_gateway_remediation::native_http_v3::{self as http, Api, Input, Request};

/// The JATO surface in scope.
const ROUTE: &[u8] = b"/openam/UI/";

/// The parameter this module inspects.
const PARAM: &[u8] = b"jato.clientSession=";

/// The serialized-Java magic marker refused in its value.
const SER_MARKER: &[u8] = b"rO0AB";

fn find(haystack: &[u8], needle: &[u8]) -> Option<usize> {
    if haystack.len() < needle.len() || needle.is_empty() {
        return None;
    }
    let mut i = 0usize;
    while i + needle.len() <= haystack.len() {
        let mut j = 0usize;
        let mut same = true;
        while j < needle.len() {
            if haystack[i + j] != needle[j] {
                same = false;
                break;
            }
            j += 1;
        }
        if same {
            return Some(i);
        }
        i += 1;
    }
    None
}

struct RefuseJavaGadget;

impl RemediationModule<Request<'_>> for RefuseJavaGadget {
    fn evaluate(&self, request: &Request<'_>, edits: &mut Edits<'_>) -> Result<Decision, Failure> {
        let _ = edits;
        let _ = match request.header_count() {
            Availability::Ready(count) => count,
            Availability::NeedMore => return Ok(Decision::NeedMore),
            Availability::Unavailable => return Err(Failure),
        };
        let message = request.message();
        let head = message.prefix();
        let line_end = head.iter().position(|&b| b == b'\r').unwrap_or(head.len());
        let request_line = &head[..line_end];
        let path_at = request_line.iter().position(|&b| b == b' ').unwrap_or(request_line.len());
        let path = &request_line[path_at + 1..];
        if !path.starts_with(ROUTE) {
            return Ok(Decision::Continue);
        }
        if !message.is_complete() {
            return Ok(Decision::NeedMore);
        }
        let body_range = match request.body_range() {
            Availability::Ready(range) => range,
            Availability::NeedMore => return Ok(Decision::NeedMore),
            Availability::Unavailable => return Err(Failure),
        };
        let body = match message.bytes(body_range)? {
            Availability::Ready(bytes) => bytes,
            Availability::NeedMore => return Ok(Decision::NeedMore),
            Availability::Unavailable => return Err(Failure),
        };
        let Some(at) = find(body, PARAM) else {
            return Ok(Decision::Continue);
        };
        let value = &body[at + PARAM.len()..];
        if value.starts_with(SER_MARKER) {
            return Ok(Decision::Refuse);
        }
        Ok(Decision::Continue)
    }
}

static API: Api = Api {
    header: ApiHeader { version: http::VERSION, table_size: size_of::<Api>() as u32 },
    input_size: size_of::<Input>() as u32,
    output_size: size_of::<ModuleOutput>() as u32,
    sink_size: size_of::<EditSink>() as u32,
    message_size: size_of::<MessageInput>() as u32,
    state_bytes: 0,
    capabilities: CONTINUE | REFUSE | NEED_MORE | EDIT,
    required_inputs: 0,
    evaluate: Some(evaluate),
};

unsafe extern "C" fn evaluate(input: *const Input, sink: *const EditSink, output: *mut ModuleOutput) -> i32 {
    unsafe { http::invoke(&RefuseJavaGadget, input, sink, output) }
}

#[unsafe(no_mangle)]
pub extern "C" fn eden_http_remediation_v3() -> *const Api {
    &API
}

#[panic_handler]
fn panic(_information: &PanicInfo<'_>) -> ! {
    loop {
        core::hint::spin_loop();
    }
}