CVE-2021-26295 PoC — RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI

Source

https://github.com/S0por/CVE-2021-26295-Apache-OFBiz-EXP

Associated Vulnerability

Title:RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI (CVE-2021-26295)
Description:Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.

Description

Apache OFBiz rmi反序列化EXP(CVE-2021-26295)

Readme

# Apache OFBiz rmi反序列化EXP(CVE-2021-26295)

目前仅支持nc弹shell


将ysoserial.jar放置在同目录下，py3运行，根据提示输入漏洞url，你的vps地址和端口

第二次使用建议删除exp.ot

本工具仅用于安全测试，禁止未授权非法攻击站点，否则后果自负。

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!