cbcvebase.
CVE-2021-26295
published 2021-03-22

CVE-2021-26295: Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.

PriorityP192critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
97.82%
99.9th percentile
Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.

Affected

3 ranges
VendorProductVersion rangeFixed in
apacheofbiz< 17.12.0617.12.06
apacheofbiz——
apache_software_foundationapache_ofbiz——

Detection & IOCsextracted from sources · hover to see the quote

path/webtools/control/SOAPService↗
  • →The vulnerable unauthenticated endpoint is /webtools/control/SOAPService — monitor HTTP POST requests to this path for unexpected or malformed SOAP/serialized Java payloads, especially from unauthenticated sources. ↗
  • →Responses containing the string 'errorMessage' in the body combined with the 'OFBiz.Visitor=' cookie in the response header are indicative of a successful interaction with the vulnerable OFBiz endpoint.
  • →DNS callback interaction can be used to confirm blind exploitation of the deserialization vulnerability — monitor for out-of-band DNS lookups triggered by payloads delivered to the SOAPService endpoint.
  • →The exploit uses a Java gadget chain for DNS interaction; detect use of Java deserialization gadget generation patterns (e.g., ysoserial-style payloads) in HTTP request bodies targeting OFBiz.
  • ·The vulnerability affects all Apache OFBiz releases before 17.12.06; the fix was introduced in 17.12.06 (commit af9ed4e). Ensure detection rules are scoped to unpatched instances running versions prior to 17.12.06. ↗
  • ·The SOAP endpoint /webtools/control/SOAPService is unauthenticated, meaning no session token or credential is required to trigger the deserialization — authentication-based detections will not catch this attack. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
vendor_apache9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.