RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI

Vulnerability

Apache OFBiz versions prior to 17.12.06 contain an unsafe deserialization flaw in the SOAP functionality. The vulnerability exists in the com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl class, which allows an attacker to craft a malicious serialized Java object and send it in a SOAP request. No authentication or special configuration is required to trigger the vulnerable code path [1].

Exploitation

An unauthenticated attacker can send a specially crafted SOAP request containing a malicious Java serialized object to the SOAP endpoint. The attacker does not need any prior access or user interaction. The exploit does not require a race window or write access; it is a straightforward deserialization attack over the network [1].

Impact

Successful exploitation enables an unauthenticated attacker to execute arbitrary code on the Apache OFBiz server with the privileges of the OFBiz process. This leads to full compromise of the application and underlying host, including data exfiltration, configuration modification, and lateral movement [1].

Mitigation

Apache OFBiz version 17.12.06, released on March 22, 2021, fixes the unsafe deserialization. Users should upgrade to this version or later. There is no known workaround for this vulnerability. The CVE is not listed in the CISA KEV catalog [1].