Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Remote Code Execution Vulnerability Patched in Apache OFBiz

One of the vulnerabilities addressed by the latest update for Apache OFBiz is an unsafe Java deserialization issue that could be exploited to execute code remotely, without authentication.

One of the vulnerabilities addressed by the latest update for Apache OFBiz is an unsafe Java deserialization issue that could be exploited to execute code remotely, without authentication.

A Java-based web framework, Apache OFBiz is an open source enterprise resource planning (ERP) system that includes a suite of applications to automate business processes within enterprise environments, and which can be used across any industry.

OFBiz is one of the platforms that was affected by a Java serialization vulnerability identified and reported in 2015, and which impacted the Apache Commons Collections and Apache Groovy libraries that OFBiz relies on.

While patches were released for both libraries, the risks associated with the use of RMI, JNDI, JMX, or Spring – and possibly other Java classes – was not eliminated. The later implementation of a whitelist was meant to add further protections from possible Java serialization vulnerabilities.

Following the addressing of an issue (CVE-2019-0189) with ObjectInputStream class, where users needed to add their own objects/classes to the list of objects used by OFBiz OOTB (Out Of The Box), Apache also implemented the option to deny objects.

Apache OFBiz 17.12.06, the sixth and final release of the 17.12 series, includes a patch for CVE-2021-26295, adding a “blacklist (to be renamed soon to denylist) in Java serialization.”

Tracked as OFBIZ-12167, the commit that addresses the security issue “adds an example based on RMI which is known to be a problem,” OFBiz expert developer Jacques Le Roux says.

The unsafe deserialization, he explains, could be exploited to execute code remotely, essentially allowing an unauthenticated attacker to successfully take over Apache OFBiz. Updating OFBiz to the 17.12.06 package should prevent possible exploitation attempts.

Advertisement. Scroll to continue reading.

Related: Possible Code Execution Flaw in Apache Struts

Related: Apache Guacamole Vulnerabilities Facilitate Attacks on Enterprises

Related: Hackers Scanning for Apache Tomcat Servers Vulnerable to Ghostcat Attacks

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.