[OFBIZ-12646] Java Deserialization vulnerability in Apache OfBiz (CVE-2022-29063)

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 18.12.06, 22.01.01
• Component/s: solr
• Sprint: Bug Crush Event - 21/2/2015
• Assignee: Jacques Le Roux
• Reporter: Jacques Le Roux
• Created: 16/Jun/22 15:12
• Updated: 05/Sep/22 05:41
• Resolved: 03/Sep/22 13:28

Description

The following vulnerability has been found by Matei "Mal" Badanoiu. It's a Java Deserialization via RMI Connection.

The OfBiz Solr plugin is configured by default to automatically make a RMI request on localhost, port 1099.
By hosting a malicious RMI server on localhost, an attacker may exploit this behavior, at server start-up or on a server restart, in order to run arbitrary code as the user that started OfBiz and potentially elevate his/her privileges.

We (security team) want to Note that this exploit can only be done on a shared server. That's why it's of low severity.