Sploitus

Exploit for Server-Side Request Forgery in Apache Ofbiz

githubexploit · 2023-12-29

Exploit Code

README35 lines
## https://sploitus.com/exploit?id=27621ADE-268E-5783-BCC7-820152859645
# CVE-2023-51467  
`exp.py` changed to command execution  

## Post.txt  
Serialization vulnerability exploitation  
## bypassauth.txt  
Authentication bypass testing  

## Cause of the vulnerability  
Due to the incorrect use of an empty value during identity verification, this approach is ineffective, resulting in an authentication bypass.  

```java
if (username == null) username = (String) session.getAttribute("USERNAME");
if (password == null) password = (String) session.getAttribute("PASSWORD");
if (token == null) token = (String) session.getAttribute("TOKEN");
if (UtilValidate.isEmpty(username)) username = (String) session.getAttribute("USERNAME");
if (UtilValidate.isEmpty(password)) password = (String) session.getAttribute("PASSWORD");
if (UtilValidate.isEmpty(token)) token = (String) session.getAttribute("TOKEN");
```

## Direct command execution  
Someone analyzed direct command execution, but this requires bypassing the Groovy filter. Is there a better way to execute it? `rce.txt`  
```java
def cmd = "your-shell-command"
def process = cmd.execute()
process.waitFor()
println "Exit code: ${process.exitValue()}")
println "Output:\n${process.text}"
```

## References  
https://github.com/apache/ofbiz-framework/commit/47e7959065b82b170da5c330ed5c17af16415ede#diff-68decfd4946b8ef0adcc4c7f18b938aec4a07ff7ce64609a2691ba88a4688607  
https://mp.weixin.qq.com/s/vdyqfm0FkbKp5W2LilhbXA  
Do not use for illegal purposes.