Deserialization of Untrusted Data in OFBiz - CVE-2021-26295
Published: March 21, 2021 / Updated: September 25, 2022
Vulnerability identifier: #VU51585
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-26295
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
OFBiz
How to mitigate CVE-2021-26295
Install updates from vendor's website.
OFBiz - update to 17.12.06
Links to Public Exploits and PoC-codes
- Exploit #8403 - CVE-2021-26295 (CVE-2021-26295 EXP 可成功反弹Shell) (September 25, 2022)
- Exploit #7240 - CVE-2021-26295-Apache-OFBiz (CVE-2021-26295 Apache OFBiz rmi反序列化POC) (January 13, 2022)
- Exploit #6801 - exp_hub (漏洞复现与poc收集，CVE-2021-21975，cve-2021-22005，CVE-2021-26295，VMware vCenter任意文件读取) (September 29, 2021)
- Exploit #6490 - CVE-2021-26295 () (June 30, 2021)
- Exploit #5564 - CVE-2021-26295-Apache-OFBiz-EXP (Apache OFBiz rmi反序列化EXP(CVE-2021-26295)) (June 15, 2021)
- Exploit #5475 - CVE-2021-26295 (CVE-2021-26295 EXP 可成功反弹Shell) (May 24, 2021)
- Exploit #5407 - ofbiz-poc (CVE-2020-9496和CVE-2021-26295利用dnslog批量验证漏洞poc及exp) (May 13, 2021)
- Exploit #5375 - Apache OFBiz SOAP Java Deserialization (May 9, 2021)