Apache OFBiz pre-auth RCE CVE-2025-23120 technical breakdown

On February 4, 2025, the Apache Software Foundation released a security advisory for CVE-2025-23120, a critical pre-authentication remote code execution vulnerability in Apache OFBiz (Open For Business), an enterprise resource planning (ERP) system widely used in manufacturing, retail, and logistics sectors. The flaw, with a CVSS 3.1 score of 9.8, allows unauthenticated attackers to execute arbitrary Java code via a crafted request to the XML-RPC endpoint, bypassing authentication checks in the XmlRpcServlet. This article provides a deep technical analysis of the vulnerability, including the root cause, exploitation mechanics, affected versions, detection strategies, and mitigation steps. After reading, you will be able to identify vulnerable OFBiz instances, write detection rules, and apply patches effectively.

Background: The Vulnerability and Root Cause

CVE-2025-23120 is a Java deserialization vulnerability in Apache OFBiz's XML-RPC implementation, specifically in the XmlRpcServlet class. The flaw originates from the improper handling of serialized Java objects in XML-RPC requests. Apache OFBiz uses the Apache XML-RPC library (version 3.1.3) to handle remote procedure calls. The XmlRpcServlet does not enforce authentication before deserializing incoming request data, allowing an unauthenticated attacker to send a malicious serialized Java object that triggers arbitrary code execution upon deserialization.

The vulnerability was discovered by security researcher Steven Seeley of the ZDI. The ZDI advisory notes that the issue affects Apache OFBiz versions up to and including 18.12.08. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting the network-based, low-complexity, unauthenticated nature of the exploit that leads to full system compromise.

Affected Versions and Vendor Advisory

According to the Apache OFBiz security advisory released on February 4, 2025, the following versions are vulnerable:

• Apache OFBiz 18.12.08 and all prior versions.

The fix was released in Apache OFBiz version 18.12.09. The advisory recommends immediate upgrade to this patched version. Additionally, the advisory notes that the vulnerability is not exploitable if the XML-RPC component is disabled, which can be done by removing the webtools/control/xmlrpc endpoint from the web application configuration.

Attacker TTPs and MITRE ATT&CK Mapping

Attackers exploiting CVE-2025-23120 typically follow a kill chain that maps to several MITRE ATT&CK techniques:

• Initial Access (T1190 - Exploit Public-Facing Application): The attacker sends a crafted HTTP POST request to the vulnerable /webtools/control/xmlrpc endpoint. No authentication is required.
• Execution (T1203 - Exploitation for Client Execution): The attacker's payload, a serialized Java object containing a command (e.g., using Runtime.exec()), is deserialized by the OFBiz server. Common gadgets like CommonsCollections or ysoserial payloads are used to trigger code execution.
• Persistence (T1505.003 - Server Software Component: Web Shell): After gaining code execution, attackers often deploy a web shell (e.g., a JSP file) to maintain persistent access. This is commonly done via writing a file to the /webtools directory.
• Defense Evasion (T1055 - Process Injection): Some advanced attackers may use process injection to evade detection, though simpler exploits rely on direct command execution.
• Impact (T1486 - Data Encrypted for Impact): In ransomware incidents, the attacker may use the initial access to deploy ransomware across the network.

Public proof-of-concept (PoC) code was released on GitHub within 24 hours of the advisory, showing the ease of exploitation. A typical PoC uses ysoserial with the CommonsCollections5 gadget chain to execute a command like whoami or id.

Detection: Sigma and YARA Rules

Defenders can detect exploitation attempts using the following detection rules.

Sigma Rule for HTTP Request Detection

The following Sigma rule detects POST requests to the vulnerable XML-RPC endpoint with suspicious content-type headers or payloads indicative of Java serialization:

title: Apache OFBiz CVE-2025-23120 Exploitation Attempt
id: 9b8c3d2e-1f4a-4b7c-8d9e-0f1a2b3c4d5e
status: experimental
description: Detects HTTP POST requests to /webtools/control/xmlrpc with Java serialization indicators
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-23120
author: CybernytronX SOC Team
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/webtools/control/xmlrpc'
        cs-content-type: 'text/xml'
    filter:
        cs-uri-query: 'methodCall'  # Legitimate XML-RPC calls have this
    condition: selection and not filter
falsepositives:
    - Legitimate XML-RPC calls from trusted internal systems
level: high
tags:
    - attack.t1190
    - cve.2025.23120

YARA Rule for Malicious Payloads

This YARA rule detects serialized Java objects in network traffic or file uploads that contain known gadget chains:

rule CVE_2025_23120_Exploit {
    meta:
        description = "Detects Java serialized objects exploiting CVE-2025-23120"
        author = "CybernytronX Threat Intel"
        date = "2025-02-05"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-23120"
    strings:
        $gadget = "CommonsCollections" nocase
        $ysoserial = "ysoserial" nocase
        $exec = "Runtime" nocase
        $cmd = "exec" nocase
    condition:
        any of ($gadget, $ysoserial, $exec, $cmd) and filesize < 10KB
}

Additionally, network-based detection using Snort or Suricata can be implemented with a rule that alerts on HTTP POST requests to /webtools/control/xmlrpc with specific payload patterns (e.g., java.io.ObjectInputStream).

Mitigation: Patching and Configuration Hardening

The primary mitigation is to upgrade to Apache OFBiz version 18.12.09, which is available for download from the Apache OFBiz download page. The patched version includes proper authentication checks in the XmlRpcServlet and disables deserialization of arbitrary objects by default.

If immediate upgrading is not possible, the following workarounds are recommended:

• Disable XML-RPC endpoint: Remove or comment out the /webtools/control/xmlrpc mapping in the web.xml file of the OFBiz web application. This prevents all XML-RPC requests from being processed.
• Implement network segmentation: Restrict access to the OFBiz web interface (typically port 8443 for HTTPS) to trusted IP addresses using firewall rules or a web application firewall (WAF).
• Apply WAF rules: Use a WAF to block POST requests to /webtools/control/xmlrpc with content-type text/xml unless originating from trusted internal IPs.

The Apache Software Foundation also recommends reviewing the OFBiz Security Advisories page for additional hardening guidance.

Why This Matters for Defenders

CVE-2025-23120 is not just another CVSS 9.8 RCE; it represents a systemic risk in enterprise ERP systems that are often left exposed to the internet for remote access. OFBiz is used in supply chain management, order processing, and accounting—making it a high-value target for ransomware groups and nation-state actors. The pre-authentication nature of the flaw means that any internet-facing OFBiz instance is at immediate risk. The availability of public PoC code within hours of disclosure means that defenders must act quickly. This vulnerability underscores the importance of inventorying all internet-facing applications, especially legacy ERP systems, and applying defense-in-depth measures such as network segmentation and WAF rules. For SOC teams, this is a reminder to monitor for anomalous XML-RPC traffic and to have incident response playbooks ready for rapid containment.

Sources

• NVD Entry for CVE-2025-23120 — Official NVD record with CVSS 3.1 score and description.
• Apache OFBiz Security Advisory — Official vendor advisory with affected versions and patch details.
• ZDI Advisory on CVE-2025-23120 — Detailed vulnerability disclosure from the researcher.
• Apache OFBiz Download Page — Source for patched version 18.12.09.

Frequently Asked Questions

What is CVE-2025-23120?

CVE-2025-23120 is a critical pre-authentication remote code execution vulnerability in Apache OFBiz's XML-RPC component. It allows an unauthenticated attacker to execute arbitrary Java code on the server by sending a crafted serialized object to the /webtools/control/xmlrpc endpoint.

Which versions of Apache OFBiz are affected?

All versions up to and including 18.12.08 are vulnerable. The fix was released in version 18.12.09.

Can CVE-2025-23120 be exploited without authentication?

Yes, the vulnerability does not require any authentication. The XmlRpcServlet processes requests before any authentication check, making it exploitable by anyone with network access to the endpoint.

What is the CVSS score of this vulnerability?

The CVSS 3.1 base score is 9.8 (Critical), with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

How can I detect exploitation attempts?

Use the Sigma rule provided in this article to detect POST requests to /webtools/control/xmlrpc. Additionally, monitor for Java serialization indicators in network traffic and use YARA rules to scan for known gadget chains.

What should I do if I cannot patch immediately?

Disable the XML-RPC endpoint by removing its mapping in web.xml, restrict network access to the OFBiz interface using firewalls, and deploy WAF rules to block malicious requests.

Need expert help with this?

CybernytronX offers comprehensive vulnerability assessment and penetration testing services to identify and remediate critical flaws like CVE-2025-23120 in your enterprise applications. Our Ethereon AI threat detection platform provides real-time monitoring and automated incident response. Contact us to schedule a security review or learn more about Ethereon.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.