cve/cves/2020/CVE-2020-9496.md

CVE-2020-9496

Description

XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03

POC

Reference

• http://packetstormsecurity.com/files/158887/Apache-OFBiz-XML-RPC-Java-Deserialization.html
• http://packetstormsecurity.com/files/161769/Apache-OFBiz-XML-RPC-Java-Deserialization.html
• http://packetstormsecurity.com/files/163730/Apache-OfBiz-17.12.01-Remote-Command-Execution.html

Github

• https://github.com/JulianWu520/DriedMango
• https://github.com/MrMeizhi/DriedMango
• https://github.com/Vulnmachines/apache-ofbiz-CVE-2020-9496
• https://github.com/ambalabanov/CVE-2020-9496
• https://github.com/cyber-niz/CVE-2020-9496
• https://github.com/dwisiswant0/CVE-2020-9496
• https://github.com/g33xter/CVE-2020-9496
• https://github.com/s4dbrd/CVE-2020-9496

Nuclei

• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9496.yaml

ExploitDB

• https://www.exploit-db.com/exploits/50178

Metasploit

• https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_ofbiz_deserialization.rb

Vulhub

• https://github.com/vulhub/vulhub/tree/master/ofbiz/CVE-2020-9496

Collections

• https://github.com/chaitin/xray/blob/master/pocs/apache-ofbiz-cve-2020-9496-xml-deserialization.yml
• https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2020/CVE-2020-9496.yaml