CVE-2018-17200

Summary

The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. This service takes the serviceContent parameter in the request and deserializes it using XStream. This XStream instance is slightly guarded by disabling the creation of ProcessBuilder. However, this can be easily bypassed (and in multiple ways). Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16 r1850017+1850019

Affected Software

VendorProductVersion RangeStatus
ApacheOFBizOFBiz 16.11.01 to 16.11.05affected

Weaknesses

  • remote code execution

ADP Enrichment

CVE Program Container

Additional References

References