Apache OFBiz 16.11.01/16.11.02/16.11.03/16.11.04 XML-RPC Event /webtools/control/xmlrpc xml external entity reference

Summaryinfo

A vulnerability classified as critical has been found in Apache OFBiz 16.11.01/16.11.02/16.11.03/16.11.04. This affects an unknown part of the file /webtools/control/xmlrpc of the component XML-RPC Event Handler. Performing a manipulation results in xml external entity reference. This vulnerability was named CVE-2011-3600. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability classified as critical has been found in Apache OFBiz 16.11.01/16.11.02/16.11.03/16.11.04. This affects some unknown processing of the file /webtools/control/xmlrpc of the component XML-RPC Event Handler. The manipulation with an unknown input leads to a xml external entity reference vulnerability. CWE is classifying the issue as CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.

The bug was discovered 10/05/2018. The weakness was presented 11/26/2019 (Website). The advisory is shared at mail-archives.apache.org. This vulnerability is uniquely identified as CVE-2011-3600 since 09/21/2011. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 03/04/2025).

The vulnerability was handled as a non-public zero-day exploit for at least 417 days. During that time the estimated underground price was around $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 217555 (Linux Distros Unpatched Vulnerability : CVE-2011-3600), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (217555). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Apache

Name

• OFBiz

Version

• 16.11.01
• 16.11.02
• 16.11.03
• 16.11.04

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion