CVE-2021-43360 — Sunnet eHRD Insecure Deserialization (Post-Auth RCE)

Executive Summary

CVE-2021-43360 is a post-authenticated insecure deserialization vulnerability in the email delivery task scheduling component of Sunnet eHRD, a human resource management platform. A remote attacker with valid credentials and database access privileges can exploit insufficient input object validation in the serialization function to achieve arbitrary code execution on the underlying system, leading to full system compromise or denial of service. The vulnerability carries a CVSS score of 8.8 (High), is not listed in CISA KEV, and has no publicly known exploit code. A patch is claimed to be available in Sunnet eHRD version 10, though this has not been independently confirmed.

Technical Analysis

The vulnerability resides in the serialization function used by Sunnet eHRD's email delivery task scheduling mechanism. Per the NVD description, the function performs "inadequate input object validation and restriction." This is the classic precondition for an insecure deserialization flaw.

Vulnerability Mechanism:

Java (or .NET) deserialization vulnerabilities occur when an application accepts serialized objects from untrusted input and reconstructs them without proper validation of the object's class type or properties. At the vulnerability-class level, the attack operates as follows:

1. An attacker crafts a malicious serialized object whose embedded class definitions trigger dangerous behavior during deserialization.
2. The serialization function in the email task scheduler fails to validate the incoming object against an allowlist of expected classes.
3. During deserialization, the object's readObject (Java) or equivalent method executes gadget chains — sequences of method calls that leverage legitimate library classes (e.g., Apache Commons Collections, Spring, etc.) to achieve code execution.
4. The attacker gains code execution in the context of the application server process.

Attack Surface:

• Authentication requirement: Post-authenticated — the attacker needs valid credentials, likely with elevated privileges (the description mentions "database access privilege").
• Target component: Email delivery task scheduling module — this implies an interface that manages scheduled email jobs, which likely accepts serialized task configurations or attachments.
• Privilege requirement: Database access privilege suggests the attacker can manipulate stored serialized objects or inject them via database-backed task definitions.

Technical Gaps:

Insufficient technical detail is available regarding the exact deserialization library, gadget chain availability, or the specific serialization format used (Java native serialization vs. JSON/XML-based). The NVD description does not specify function names, class names, or endpoint paths. Analysis of the exploit mechanism is therefore provided at the vulnerability-class level.

CVSS Rationale (reconstructed):

• Attack Vector: Network — remotely exploitable via the web application.
• Attack Complexity: Low — no special conditions required beyond authentication.
• Privileges Required: Low — requires post-authentication access with database privilege.
• User Interaction: None — the attacker does not need to trick another user.
• Confidentiality/Integrity/Availability: High/High/High — full code execution leads to complete compromise.

Exploitation Scenarios

No public PoC is available for CVE-2021-43360; the attack chain described below is inferred from the vulnerability class and NVD description.

Stage 1: Reconnaissance / Target Identification

1. The attacker identifies a Sunnet eHRD instance exposed to the internet (via Shodan, Fofa, or Google dorks like "eHRD").
2. The attacker obtains valid credentials through credential stuffing, phishing, or by leveraging separate credentials leak (the vulnerability is post-authenticated, so initial access is required).
3. The attacker verifies the target version is prior to version 10 (unpatched).

Stage 2: Triggering the Flaw

1. With authenticated access, the attacker navigates to the email delivery task scheduling interface.
2. The attacker creates or edits a scheduled email task.
3. Instead of providing a legitimate task configuration, the attacker submits a crafted serialized Java object in the task's attachment/configuration field. The serialization function fails to validate the object's class hierarchy and accepts the malicious payload.

Stage 3: Payload Execution

1. During deserialization, the crafted object's readObject method is invoked.
2. A gadget chain employing common Java libraries (e.g., Apache Commons Collections, Spring AOP, or Groovy) is triggered.
3. The gadget chain executes an OS command (e.g., Runtime.exec() with a reverse shell or a command to download and execute a web shell/beacon).
4. The attacker gains a shell in the context of the eHRD application server.

Stage 4: Post-Exploitation Impact

1. Full system take-over: attacker has code execution and can read/write all application data, including HR records, PII (national ID numbers, salary info, health data).
2. Lateral movement: the application server may have access to database servers, adjacent internal infrastructure.
3. Database compromise: given the attacker already has database access privilege, they can also extract the entire HR database directly.
4. Availability disruption: the attacker can terminate the application service or wipe data (matching the "interrupt services" impact in the NVD description).

Impact Assessment

Business Impact:

• High confidentiality impact (CVSS C:H): eHRD systems store highly sensitive personal data — employee PII, salary information, health records, national ID/passport numbers. Full compromise constitutes a significant data breach with regulatory implications (GDPR, APPI in Japan, PIPEDA, etc.).
• High integrity impact (CVSS I:H): arbitrary code execution allows the attacker to alter HR records, manipulate payroll runs, modify access control rules, and plant backdoors.
• High availability impact (CVSS A:H): service interruption is explicitly cited in the NVD description.

Affected Systems:

• Sunnet eHRD versions prior to version 10.
• Any organization deploying Sunnet eHRD with internet-facing email task scheduling features.
• The user base is concentrated in Asia-Pacific regions (Taiwan/Japan heritage of Sunnet products), potentially including large enterprises, government agencies, and healthcare organizations.

Blast Radius:

• The eHRD application server is the primary target, but database servers and the broader internal network are secondary targets.
• Since email task scheduling implies SMTP integration, the compromised server can also be abused for spam or phishing campaigns.
• EPSS score: 0.02328 (81.9% percentile) — the vulnerability is in the top ~18% of CVEs by predicted exploitation likelihood. This suggests moderate-to-high risk of being exploited in the wild, despite the lack of public PoC.

Detection Guidance

Sigma Rule

title: Sunnet eHRD Insecure Deserialization - Suspicious Java Object in Email Task
id: 02258c1e-2f84-4ad8-9c31-3d4e9ec8a5b1
status: experimental
description: Detects attempts to submit crafted Java serialized objects to Sunnet eHRD email task scheduling interfaces, indicating potential insecure deserialization exploitation (CVE-2021-43360).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-43360
author: vartersit.com Threat Intel Team
date: 2024/01/15
logsource:
    category: web_application
    product: sunnet_ehrd
detection:
    selection_base:
        cs-method: 'POST'
        cs-uri-query|contains:
            - 'emailTask'
            - 'scheduleTask'
            - 'taskSerialization'
    selection_deserial_payload:
        cs-uri-query|contains|all:
            - 'serialization'
            - 'object'
    selection_java_markers:
        cs-user-agent|contains:
            - 'curl'
            - 'wget'
            - 'python-requests'
        cs-body|contains|all:
            - 'rO0AB'          # Base64-encoded Java serialized object header
            - 'AC ED 00 05'    # Hex-encoded Java serialized object header
    condition: selection_base and (selection_deserial_payload or selection_java_markers)
level: high
falsepositives:
    - Legitimate use of serialized task definitions, if supported by the application
fields:
    - srcip
    - cs-user-agent
    - cs-body
tags:
    - attack.t1190
    - attack.t1203
    - cve.2021-43360
    - cwe.502

YARA Rule

rule Sunnet_eHRD_Serialized_Exploit_Payload
{
    meta:
        author = "vartersit.com Threat Intel"
        description = "Detects Java serialized objects that may exploit CVE-2021-43360 in Sunnet eHRD"
        cve = "CVE-2021-43360"
        severity = "high"
        date = "2024-01-15"

    strings:
        // Java serialization stream magic bytes (AC ED 00 05) in either raw or Base64 form
        $java_ser_raw = { AC ED 00 05 }
        $java_ser_b64  = "rO0AB"
        
        // Common gadget chain class markers
        $cc_chain1 = "org.apache.commons.collections.Transformer"
        $cc_chain2 = "org.apache.commons.collections.functors.InvokerTransformer"
        $cc_chain3 = "com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl"
        $cc_chain4 = "org.springframework.beans.factory.ObjectFactory"
        
        // Runtime execution hints
        $exec_hint1 = "Runtime"
        $exec_hint2 = "ProcessBuilder"
        $exec_hint3 = "getRuntime"
        
        // Task scheduling context
        $task_context = "emailTask"
        $task_context2 = "taskSchedule"

    condition:
        uint16(0) == 0xACED and uint16(2) == 0x0005 and any of ($cc_chain*)
        or
        ($java_ser_b64 and any of ($cc_chain*) and any of ($exec_hint*))
        or
        ($java_ser_b64 and any of ($task_context*) and >1 of ($exec_hint*))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"SURICATA - Sunnet eHRD Insecure Deserialization Attempt (CVE-2021-43360)";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"emailTask"; http_uri; fast_pattern;
    content:"rO0AB"; http_client_body;
    pcre:"/rO0AB[A-Za-z0-9+\/]{100,}/Ri";          # Base64 serialized object, min 100 chars
    pcre:"/(?:InvokerTransformer|TemplatesImpl|CommonsCollections|ProcessBuilder|Runtime)/Ui";
    sid:10043360;
    rev:1;
    metadata:attack_target Web_Server, cve CVE-2021-43360, created_at 2024_01_15;
    reference:cve,2021-43360;
    reference:url,nvd.nist.gov/vuln/detail/CVE-2021-43360;
    classtype:attempted-user;
    priority:1;
)

Note: The pcre matching for gadget-chain class names targets Base64-decoded content overlap detection. In practice, operators should also deploy a companion rule that inspects decoded Base64 HTTP bodies using a scripting engine (e.g., a Lua script for Suricata) for more accurate detection.

Elastic Detection

// EQL query for elastic detection
sequence by source.ip
  [network where event.action in ("http_request", "http_response") and
   process.name == "java" and
   dst.port == 443]
  [file where event.action == "filewrite" and
   file.extension in ("ser", "bin", "tmp") and
   process.name == "java"]
  [process where event.action == "exec" and
   process.parent.name == "java" and
   (process.command_line contains "calc" or
    process.command_line contains "/bin/sh" or
    process.command_line contains "cmd.exe" or
    process.command_line contains "wget" or
    process.command_line contains "curl" or
    process.command_line contains "nc.exe")]
| where -true

Splunk SPL Query

index=web OR index=proxy sourcetype=iis:log OR sourcetype=apache:access 
| where POST like "%" and uri like "%emailTask%"
| rex field=_raw "rO0AB(?<b64_payload>[A-Za-z0-9+\/]+)"
| where len(b64_payload) > 100
| eval decoded_payload = base64_decode(b64_payload)
| where decoded_payload LIKE "%InvokerTransformer%" OR decoded_payload LIKE "%TemplatesImpl%" 
       OR decoded_payload LIKE "%CommonsCollections%" OR decoded_payload LIKE "%ProcessBuilder%"
| table _time, src_ip, uri, http_method, user_agent, decoded_payload
| stats count by src_ip, uri

// Additional search for process-level detection (Windows)
index=windows_sysmon EventCode=1
| where ParentImage LIKE "%java.exe" or ParentImage LIKE "*tomcat*"
| where CommandLine LIKE "%cmd.exe%" or CommandLine LIKE "%powershell%" or CommandLine LIKE "%/bin/sh%"
| table _time, host, User, ParentImage, CommandLine

Wazuh OSSEC Rule

<group name="sunnet_ehrd,">
  <!-- CVE-2021-43360 - Sunnet eHRD Insecure Deserialization payload in HTTP request -->
  <rule id="100336" level="15">
    <decoded_as>json</decoded_as>
    <field name="event.module">modsecurity</field>
    <match>rO0AB</match>
    <regex>emailTask|taskSchedule|scheduleTask</regex>
    <description>Sunnet eHRD (CVE-2021-43360) - Java serialized object detected in email task scheduling request</description>
    <group>cve-2021-43360,deserialization,rce,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <!-- Process execution from Java/application server with suspicious child process -->
  <rule id="100337" level="12">
    <if_sid>100336</if_sid>
    <match>ChildProcess|ERROR|Exception</match>
    <description>Sunnet eHRD - Suspicious process spawned after deserialization attempt</description>
    <group>cve-2021-43360,rce,</group>
  </rule>

  <!-- Web server error indicating deserialization failure/stack trace -->
  <rule id="100338" level="8">
    <if_sid>100336</if_sid>
    <match>ClassNotFoundException|StreamCorruptedException|InvalidClassException</match>
    <description>Sunnet eHRD - Deserialization error stack trace observed (potential exploitation attempt)</description>
    <group>cve-2021-43360,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED (e.g., single source claims patch, not independently confirmed)

The only patch reference originates from the CNA (Sunnet itself), indicating the fix is available in version 10. No independent researcher, government advisory, or security vendor has confirmed or tested this patch as of this report.

Immediate Mitigations (before patching):

1. Restrict access: Place Sunnet eHRD behind a VPN or zero-trust architecture. Do not expose it directly to the internet.
2. Enforce strong authentication: Require MFA for all accounts with database access privileges. Disable default accounts.
3. Apply application-layer filtering: Deploy a WAF rule to block requests containing Java serialized object markers (rO0AB, AC ED 00 05) to the email task scheduling endpoints.
4. Network segmentation: Isolate the eHRD application server from the broader corporate network to limit blast radius.
5. Activity monitoring: Enable detailed logging of email task scheduling operations and monitor for anomalous process execution from the application server.

Patch / Upgrade Steps:

1. Obtain Sunnet eHRD version 10 from official vendor channels. Verify authenticity of the update package.
2. Back up the eHRD database and application configuration.
3. Run the upgrade in a staging environment first; validate email task scheduling functionality.
4. Deploy to production, then verify version and re-check the serialization function behavior.

Long-term Hardening:

1. Upgrade to secured deserialization frameworks: Whenever the application permits, use allowlisted class filtering (e.g., Apache Commons Collections's ObjectInputStream subclass with class allowlisting).
2. Principle of least privilege: Ensure application database accounts do not have elevated privileges; separate read/write credentials.
3. Patch management lifecycle: Enforce a 30-day SLA for applying security patches to HR applications given the sensitive nature of the data.
4. Vendor relationship: Maintain an active channel with Sunnet; request direct notification of security advisories.
5. Alternative security controls: If the vendor patch cannot be confirmed, plan for migrating from Sunnet eHRD to an alternative HRMS platform with a more active security posture.

References

1. NIST NVD Entry — CVE-2021-43360: https://nvd.nist.gov/vuln/detail/CVE-2021-43360
2. Sunnet (CNA) Advisory — patch reference for version 10 (via CVE data feed)
3. MITRE ATT&CK Technique T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
4. OWASP Deserialization Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2021-43360 NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Activity: No known threat actor campaigns, ransomware operations, or exploit-in-the-wild activity has been publicly attributed to this CVE. The EPSS percentile (81.9%) indicates a moderate probability of eventual exploitation, but as of this report, no active exploitation has been confirmed.