CVE-2020-9496: Apache OFBiz XML-RPC Java Deserialization

日期: 2025-09-01 | 影响软件: Apache OFBiz | POC: 已公开

漏洞描述

XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03

PoC代码[已公开]

id: CVE-2020-9496

info:
  name: Apache OFBiz XML-RPC Java Deserialization
  author: dwisiswant0
  severity: medium
  description: XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03
  tags: cve,cve2020,apache,java,ofbiz
  reference:
    - http://packetstormsecurity.com/files/158887/Apache-OFBiz-XML-RPC-Java-Deserialization.html
    - http://packetstormsecurity.com/files/161769/Apache-OFBiz-XML-RPC-Java-Deserialization.html
    - https://securitylab.github.com/advisories/GHSL-2020-069-apache_ofbiz
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.10
    cve-id: CVE-2020-9496
    cwe-id: CWE-79,CWE-502

set:
    rand: randomInt(200000000, 210000000)
rules:
    r0:
        request:
            method: POST
            path: /webtools/control/xmlrpc
            headers:
                Content-Type: application/xml
            body: <?xml version="1.0"?><methodCall><methodName>{{rand}}</methodName><params><param><value>dwisiswant0</value></param></params></methodCall>
        expression: response.status == 200 && response.content_type.contains("xml") && response.body.bcontains(bytes("methodResponse")) && response.body.bcontains(bytes("No such service [" + string(rand)))
expression: r0()
来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2020/CVE-2020-9496.yaml

相关漏洞推荐