Description
Apache OFBiz存在不安全的反序列化漏洞，此漏洞是缺乏校验导致的。
Apache OFBiz CVE-2021-29200 不安全的反序列化漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/cve-2021-29200
https://s.apache.org/CVE-2021-29200
https://www.aliyun.com/notice/112974
https://blog.vackbot.com/archives/apacheofbizcve-2021-29200-fan-xu-lie-hua-lou-dong-fen-xi
https://www.huaweicloud.com/intl/zh-cn/notice/20210428154555324.html
https://nosec.org/m/share/4746.html
http://pub-shbt.s3.360.cn/cert-public-file/%E3%80%90360CERT%E3%80%91Apache_OFBiz%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E9%80%9A%E5%91%8A.pdf
https://www.venustech.com.cn/new_type/aqtg/20210428/22646.html
https://www.h3c.com/cn/d_202112/1519665_30003_0.htm
https://blog.csdn.net/weixin_45728976/article/details/116321829
https://www.cstis.cn/post/3abddbc1-cf36-ce9a-8b6d-d103986dcc79
https://ofbiz.apache.org/security.html
https://ridgesecurity.ai/blog/apache-ofbiz-three-deserialization-vulnerabilities-analysis-cve-2021-26295-cve-2021-29200-cve-2021-30128/
https://pentest-tools.com/vulnerabilities-exploits/apache-ofbiz-171207-arbitrary-code-execution_22433
https://www.cve.org/CVERecord?id=CVE-2021-29200
https://www.openwall.com/lists/oss-security/2021/04/27/4