Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-26295
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI
Source: NVD (National Vulnerability Database)
Vulnerability Description
Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apache OFBiz 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache OFBiz是美国阿帕奇（Apache）基金会的一套企业资源计划（ERP）系统。该系统提供了一整套基于Java的Web应用程序组件和工具。 Apache OFBiz prior to 17.12.06 存在安全漏洞，该漏洞源于不安全的反序列化，攻击者可利用该漏洞可以完全控制Apache OFBiz系统。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
VendorProductAffected VersionsCPESubscribe
Apache Software FoundationApache OFBiz Apache OFBiz 17.12.01 to 17.12.05 -
II. Public POCs for CVE-2021-26295
#POC DescriptionSource LinkShenlong Link
1Nonehttps://github.com/yumusb/CVE-2021-26295POC Details
2CVE-2021-26295 Apache OFBiz rmi反序列化POChttps://github.com/rakjong/CVE-2021-26295-Apache-OFBizPOC Details
3CVE-2021-26295 EXP 可成功反弹Shellhttps://github.com/dskho/CVE-2021-26295POC Details
4CVE-2021-26295-POC 利用DNSlog进行CVE-2021-26295的漏洞验证。 使用 poc：将目标放于target.txt后运行python poc.py即可。（Jdk环境需<12，否则ysoserial无法正常生成有效载荷） exp：python exp.py https://baidu.com然后进入命令执行界面（无回显）https://github.com/coolyin001/CVE-2021-26295--POC Details
5Apache OFBiz rmi反序列化EXP(CVE-2021-26295)https://github.com/S0por/CVE-2021-26295-Apache-OFBiz-EXPPOC Details
6CVE-2020-9496和CVE-2021-26295利用dnslog批量验证漏洞poc及exphttps://github.com/yuaneuro/ofbiz-pocPOC Details
7Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-26295.yamlPOC Details
8Nonehttps://github.com/Threekiii/Awesome-POC/blob/master/%E5%BC%80%E5%8F%91%E6%A1%86%E6%9E%B6%E6%BC%8F%E6%B4%9E/Apache%20OFBiz%20RMI%20Bypass%20RCE%20CVE-2021-29200.mdPOC Details
9Nonehttps://github.com/Threekiii/Awesome-POC/blob/master/%E5%BC%80%E5%8F%91%E6%A1%86%E6%9E%B6%E6%BC%8F%E6%B4%9E/Apache%20OFBiz%20RMI%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E6%BC%8F%E6%B4%9E%20CVE-2021-26295.mdPOC Details
AI-Generated POCPremium

No public POC found.

Login to generate AI POC
III. Intelligence Information for CVE-2021-26295
Please Login to view more intelligence information
IV. Related Vulnerabilities
Same product: Apache OFBiz
Same vendor: Apache Software Foundation
V. Comments for CVE-2021-26295

No comments yet

Leave a comment