Welcome to the Wallarm weekly web exploits digest! Since this week, we will publish our weekly digests consists of web exploits with CVSS scores higher than 5. It will be followed by explanations, risks analysis, related stories and news. So, here we go!
The most sophisticated and interesting exploit was out of this score for some reason, but who we are to argue with CVSS score 😉 This is the Apache OFBiz XML-RPC Java Serialization Remote Code Execution issues https://vulners.com/packetstorm/PACKETSTORM:161769 where you can find a XML-packed and Base64 encoded Java deserialization payload:
<name>#{rand_text_alphanumeric(8..42)}</name>
<value>
<serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">#{Rex::Text.encode_base64(data)}</serializable>
</value>
