ALMOST IMPOSSIBLE: JAVA DESERIALIZATION THROUGH BROKEN CRYPTO IN OPENTEXT DIRECTORY SERVICES

Summary from the TLDR InfoSec newsletter

Searchlight Cyber (Assetnote) discovered an unauthenticated Java deserialization vulnerability in OpenText Directory Services (OTDS) exploitable in its default configuration, stemming from a flawed HMAC signature verification where attacker-controlled length fields allowed truncating the signed message to begin at an injected payload. Exploitation required building a custom Deflate compressor with tailored Huffman codes to produce output restricted to valid modified UTF-8 bytes (0x01-0x7F) while remaining incompressible by zlib, enabling the payload to survive a double-compression pipeline intact. Organizations running OTDS should patch immediately, as a compromise could affect all integrated OpenText applications that rely on it for authentication.