Loading vulnerability…
CVE-2020-9496 is a vulnerability in Apache OFBiz 17.12.03 affecting XML-RPC request handling. The issue is caused by unsafe deserialization of attacker-controlled data in XML-RPC requests, which can allow untrusted serialized content to be processed by the application. The vulnerability has also been associated with cross-site scripting exposure in the same XML-RPC functionality. In practice, the unsafe deserialization condition is the security issue most directly associated with remote compromise risk and has been referenced in exploitation contexts as leading to remote code execution against Apache OFBiz.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a single Metasploit module (modules/exploits/linux/http/apache_ofbiz_deserialization.rb) that exploits a Java deserialization vulnerability in Apache OFBiz's XML-RPC endpoint. The exploit targets the /webtools/control/xmlrpc endpoint, which is accessible over HTTP(S), and leverages unauthenticated or authentication-bypassed access to achieve remote code execution. The module supports multiple payloads, including command execution and Meterpreter reverse shells, and automatically selects the appropriate gadget chain (ROME or CommonsBeanutils1) based on the detected OFBiz version. The exploit is weaponized, allowing for easy payload customization and reliable exploitation. The module references several CVEs (CVE-2020-9496, CVE-2023-49070, CVE-2023-51467) and is suitable for targeting vulnerable Apache OFBiz installations on Linux platforms.
This repository contains a Bash exploit script (cve-2020-9496.sh) and a README for CVE-2020-9496, a remote code execution vulnerability in Apache OFBiz 17.12.01 due to unsafe Java deserialization in the /webtools/control/xmlrpc endpoint. The exploit works by generating a malicious serialized Java payload using ysoserial, which is sent to the vulnerable endpoint via a crafted XML-RPC request. The payload instructs the target to download a shell script from the attacker's HTTP server and execute it, resulting in a reverse shell connection back to the attacker's netcat listener. The README provides clear usage instructions, including setting up the attacker's HTTP server and netcat listener, and modifying the script to target the correct URL and port. The exploit is operational and provides a working reverse shell if the target is vulnerable and accessible. The main fingerprintable endpoints are the vulnerable XML-RPC endpoint on the target, the attacker's HTTP server hosting the shell script, and the file path on the target where the shell script is saved and executed.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote code execution vulnerability in Apache OFBiz identified as one of the exploits used by Sysrv.
A remote code execution vulnerability in Apache OFBiz that Sysrv incorporated for propagation.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.