You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@ofbiz.apache.org by "Jacques Le Roux (Jira)" <ji...@apache.org> on 2021/10/08 17:24:00 UTC
[jira] [Closed] (OFBIZ-12332) post-auth Remote Code Execution
Vulnerability
[ https://issues.apache.org/jira/browse/OFBIZ-12332?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jacques Le Roux closed OFBIZ-12332.
-----------------------------------
Fix Version/s: Release Branch 17.12
18.12.01
Resolution: Fixed
More info at
https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEXMLRPC-542690
https://lists.apache.org/thread.html/5521340d91df447972f7aa6cacec38f268f3ee69cf552e90937fc5fb%401389650346%40%3Cdev.ws.apache.org%3E
> post-auth Remote Code Execution Vulnerability
> ---------------------------------------------
>
> Key: OFBIZ-12332
> URL: https://issues.apache.org/jira/browse/OFBIZ-12332
> Project: OFBiz
> Issue Type: Sub-task
> Components: framework/webtools
> Affects Versions: Trunk
> Reporter: Jie Zhu
> Assignee: Jacques Le Roux
> Priority: Minor
> Fix For: 18.12.01, Release Branch 17.12
>
> Attachments: LocallyAdaptedPayload.txt, image-2021-10-03-11-43-20-021.png, image-2021-10-03-11-43-31-228.png, payload.txt, payload_20211008.txt, payload_windows.txt
>
>
> I found that the latest version of the OFBiz framework was affected by an XMLRPC Remote Code Execution Vulnerability.
> This vulnerability is caused by incomplete patch repair of cve-2020-9496.
> !image-2021-10-03-11-43-20-021.png!
> Successful exploit:
> !image-2021-10-03-11-43-31-228.png!
> Please refer to the attachment for payload details.This HTTP request will execute the command `touch /tmp/success` file on the attacked server.
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)