• Sprint:
      Bug Crush Event - 21/2/2015


      2020/08/10 the OFBiz security team received a security report by Harshit Shukla <>, roughly it was (quoting part of it to simplify):

      I have identified a Remote Code Execution (RCE) Vulnerability. The reason behind this RCE is lack of file extension check at catalog/control/UploadCategoryImage?productCategoryId=CATALOG1_BEST_SELL&pload_file_type=category

      Using this post-auth RCE in OFBiz demos, Harshit was able to get some AWS credentials by uploading a webshell (based on [0]). By security, it was then decided by the Infra and OFBiz security teams to shut down the demos.

      After I decided we needed to secure all our uploads and not only checking extensions, I began to work on the vulnerablity. During this work I discovered, according to [1] and [2], that these AWS credentials are so far considered harmless.

      This post-auth RCE relies on the demo data. In our documentation[3], we warn our users to not use the demo data. Notably because they allow to sign in as an admin!

      After discussing these elements with Mark J Cox (VP of ASF security team[4]) we in common decided that no CVE was necessary.



        1. OFBIZ-12080.patch
          3 kB
          Jacques Le Roux

          Issue Links



              • Assignee:
                jleroux Jacques Le Roux
                jleroux Jacques Le Roux
              • Votes:
                0 Vote for this issue
                2 Start watching this issue


                • Created: