Skip to content
OpenAdvisories
Unscored Scanner template Public exploit CVE-2021-26295 EUVD-2021-13106GHSA-hp7h-f9pw-x5wj

RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI

Published Mar 22, 2021 · Updated Feb 13, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache OFBiz

Description

Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache OFBiz Apache OFBiz 17.12.01 to 17.12.05 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

GitHub 5 repositories

  • yumusb/CVE-2021-26295 ★ 23 · Mar 23, 2021
  • yuaneuro/ofbiz-poc ★ 5 · May 13, 2021

    CVE-2020-9496和CVE-2021-26295利用dnslog批量验证漏洞poc及exp

  • rakjong/CVE-2021-26295-Apache-OFBiz ★ 4 · Mar 24, 2021

    CVE-2021-26295 Apache OFBiz rmi反序列化POC

  • coolyin001/CVE-2021-26295-- ★ 0 · Apr 9, 2021

    CVE-2021-26295-POC 利用DNSlog进行CVE-2021-26295的漏洞验证。 使用 poc：将目标放于target.txt后运行python poc.py即可。（Jdk环境需<12，否则ysoserial无法正常生成有效载荷） exp：python exp.py https://baidu.com然后进入命令执行界面（无回显）

  • dskho/CVE-2021-26295 ★ 0 · Mar 25, 2021

    CVE-2021-26295 EXP 可成功反弹Shell

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

References