One of the vulnerabilities addressed by the latest update for Apache OFBiz is an unsafe Java deserialization issue that could be exploited to execute code remotely, without authentication.
A Java-based web framework, Apache OFBiz is an open source enterprise resource planning (ERP) system that includes a suite of applications to automate business processes within enterprise environments, and which can be used across any industry.
OFBiz is one of the platforms that was affected by a Java serialization vulnerability identified and reported in 2015, and which impacted the Apache Commons Collections and Apache Groovy libraries that OFBiz relies on.
While patches were released for both libraries, the risks associated with the use of RMI, JNDI, JMX, or Spring – and possibly other Java classes – was not eliminated. The later implementation of a whitelist was meant to add further protections from possible Java serialization vulnerabilities.
Following the addressing of an issue (CVE-2019-0189) with ObjectInputStream class, where users needed to add their own objects/classes to the list of objects used by OFBiz OOTB (Out Of The Box), Apache also implemented the option to deny objects.
Apache OFBiz 17.12.06, the sixth and final release of the 17.12 series, includes a patch for CVE-2021-26295, adding a “blacklist (to be renamed soon to denylist) in Java serialization.”
Tracked as OFBIZ-12167, the commit that addresses the security issue “adds an example based on RMI which is known to be a problem,” OFBiz expert developer Jacques Le Roux says.
The unsafe deserialization, he explains, could be exploited to execute code remotely, essentially allowing an unauthenticated attacker to successfully take over Apache OFBiz. Updating OFBiz to the 17.12.06 package should prevent possible exploitation attempts.
Related: Possible Code Execution Flaw in Apache Struts
Related: Apache Guacamole Vulnerabilities Facilitate Attacks on Enterprises
Related: Hackers Scanning for Apache Tomcat Servers Vulnerable to Ghostcat Attacks
More from Ionut Arghire
- Former Ubiquiti Employee Who Posed as Hacker Pleads Guilty
- Atlassian Warns of Critical Jira Service Management Vulnerability
- Exploitation of Oracle E-Business Suite Vulnerability Starts After PoC Publication
- Google Shells Out $600,000 for OSS-Fuzz Project Integrations
- F5 BIG-IP Vulnerability Can Lead to DoS, Code Execution
- Flaw in Cisco Industrial Appliances Allows Malicious Code to Persist Across Reboots
- HeadCrab Botnet Ensnares 1,200 Redis Servers for Cryptomining
- Malicious NPM, PyPI Packages Stealing User Information
Latest News
- Fraudulent “CryptoRom” Apps Slip Through Apple and Google App Store Review Process
- US Downs Chinese Balloon Off Carolina Coast
- Microsoft: Iran Unit Behind Charlie Hebdo Hack-and-Leak Op
- Feds Say Cyberattack Caused Suicide Helpline’s Outage
- Big China Spy Balloon Moving East Over US, Pentagon Says
- Former Ubiquiti Employee Who Posed as Hacker Pleads Guilty
- Cyber Insights 2023: Venture Capital
- Atlassian Warns of Critical Jira Service Management Vulnerability
