OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

A pre-authentication remote code execution vulnerability affects OpenAM. The
remote authentication endpoint (/authservice, PLL) accepts an XML element
that names an arbitrary Java class, which the server then loads and
instantiates without validation. On a default configuration this is reachable
without authentication and allows an attacker to run code on the server.

Unauthenticated remote code execution / full server compromise on any OpenAM
instance with default settings.

All releases up to and including 16.1.1 (the defect predates the Open Identity
Platform fork).

Upgrade to 16.1.2.

• Require the remote-auth security token by enabling
  sunRemoteAuthSecurityEnabled (rejects unauthenticated /authservice calls).
• Restrict or block external network access to /authservice until patched.

Vulnerability discovered by Zhixi "Jace" Sun of ASM/VI at TikTok.