Critical RCE Vulnerability Found in Apache OFBiz ERP Software—Patch Now

The Apache Software Foundation on Friday addressed a high
severity vulnerability in Apache OFBiz that could have allowed an
unauthenticated adversary to remotely seize control of the
open-source enterprise resource planning (ERP) system.

Tracked as CVE-2021-26295^[1], the flaw affects all
versions of the software prior to 17.12.06^[2]
and employs an “unsafe deserialization” as an attack vector to
permit unauthorized remote attackers to execute arbitrary code on a
server directly.

OFBiz^[3]
is a Java-based web framework for automating enterprise processes
and offers a wide range of functionality, including accounting,
customer relationship management, manufacturing operations
management, order management, supply chain fulfillment, and
warehouse management system, among others.

Specifically, by exploiting this flaw, a malicious party can
tamper with serialized data to insert arbitrary code that, when
deserialized, can potentially result in remote code execution.

“An unauthenticated attacker can use this vulnerability to
successfully take over Apache OFBiz,” OFBiz developer Jacques Le
Roux noted^[4].

Unsafe deserialization has been a source of data integrity^[5] and other security
issues, with the Open Web Application Security Project (OWASP)
noting^[6]
that “data which is untrusted cannot be trusted to be well formed,
[and that] malformed data or unexpected data could be used to abuse
application logic, deny service, or execute arbitrary code, when
deserialized.”

r00t4dm at Cloud-Penetrating Arrow Lab, MagicZero from SGLAB of
Legendsec at Qi’anxin Group, and Longofo at Knownsec 404 Team have
been credited with reporting the vulnerability.

It’s recommended to upgrade Apache OFBiz to the latest
version^[7] (17.12.06) to mitigate
the risk associated with the flaw.