Fixed: Apache OFBiz unsafe deserialization of XMLRPC arguments (CVE-2020-9496)

(OFBIZ-11716)

Because the 2 xmlrpc related requets in webtools (xmlrpc and ping) are not using
authentication they are vulnerable to unsafe deserialization.

thanks: Alvaro Munoz <pwntester@github.com> from the GitHub Security Lab team

Author: JacquesLeRoux

framework/service/src/main/java/org/apache/ofbiz/service/engine/XMLRPCClientEngine.java

@@ -98,6 +98,10 @@ private Map<String, Object> serviceInvoker(ModelService modelService, Map<String
                 Integer port = rpcPort + Start.getInstance().getConfig().portOffset;
                 url = url.replace(rpcPort.toString(), port.toString());
             }
+            // Necessary for "service-xml-rpc-local-engine" test
+            if (serviceName.equals("testXmlRpcAdd")) {
+                url = url + "?USERNAME=admin&PASSWORD=ofbiz";
+            }
             login = ServiceConfigUtil.getEngineParameter(engine, "login");
             password = ServiceConfigUtil.getEngineParameter(engine, "password");
             keyStoreComponent = ServiceConfigUtil.getEngineParameter(engine, "keyStoreComponent");

framework/service/src/main/java/org/apache/ofbiz/service/test/XmlRpcTests.java

@@ -38,7 +38,7 @@ public class XmlRpcTests extends AbstractXmlRpcTestCase {
 
     public static final String module = XmlRpcTests.class.getName();
     public static final String resource = "ServiceErrorUiLabels";
-    private static String url = "http://localhost:8080/webtools/control/xmlrpc";
+    private static String url = "http://localhost:8080/webtools/control/xmlrpc?USERNAME=admin&PASSWORD=ofbiz";
 
     public XmlRpcTests(String name) {
         super(name);

framework/webtools/webapp/webtools/WEB-INF/controller.xml

@@ -55,13 +55,14 @@ under the License.
         <response name="success" type="none"/>
     </request-map>
     <request-map uri="xmlrpc" track-serverhit="false" track-visit="false">
-        <security https="false"/>
+        <security auth="true"/>
         <event type="xmlrpc"/>
         <response name="error" type="none"/>
         <response name="success" type="none"/>
     </request-map>
 
     <request-map uri="ping">
+        <security auth="true"/>
         <event type="service" invoke="ping"/>
         <response name="error" type="view" value="ping"/>
         <response name="success" type="view" value="ping"/>