New PoC Exploit for Apache OfBiz Vulnerability Poses Risk to ERP Systems

Cybersecurity scientists have produced a proof-of-thought (PoC) code that exploits a lately disclosed critical flaw in the Apache OfBiz open-resource Business Useful resource Arranging (ERP) process to execute a memory-resident payload.

The vulnerability in problem is CVE-2023-51467 (CVSS rating: 9.8), a bypass for yet another extreme shortcoming in the exact software package (CVE-2023-49070, CVSS score: 9.8) that could be weaponized to bypass authentication and remotely execute arbitrary code.

Even though it was fastened in Apache OFbiz version 18.12.11 unveiled final thirty day period, threat actors have been observed attempting to exploit the flaw, focusing on susceptible cases.

The most recent findings from VulnCheck show that CVE-2023-51467 can be exploited to execute a payload right from memory, leaving minimal to no traces of malicious activity.

Security flaws disclosed in Apache OFBiz (e.g., CVE-2020-9496) have been exploited by danger actors in the past, which include by risk actors related with the Sysrv botnet. A further 3-12 months-aged bug in the program (CVE-2021-29200) has witnessed exploitation attempts from 29 one of a kind IP addresses in excess of the past 30 times, for every details from GreyNoise.

What’s much more, Apache OFBiz was also 1 of the to start with products and solutions to have a public exploit for Log4Shell (CVE-2021-44228), illustrating that it continues to be of interest to each defenders and attackers alike.

CVE-2023-51467 is no exception, with facts about a distant code execution endpoint (“/webtools/handle/ProgramExport”) as very well as PoC for command execution rising basically times following public disclosure.

While security guardrails (i.e., Groovy sandbox) have been erected such that they block any tries to upload arbitrary web shells or operate Java code by using the endpoint, the incomplete mother nature of the sandbox indicates that an attacker could operate curl commands and get hold of a bash reverse shell on Linux methods.

“For an highly developed attacker, however, these payloads are not great,” VulnCheck’s Main Technology Officer Jacob Baines claimed. “They touch the disk and depend on Linux-distinct actions.”

The Go-primarily based exploit devised by VulnCheck is a cross-system remedy that functions on both Windows and Linux as nicely as gets all around the denylist by getting advantage of groovy.util.Eval functions to start an in-memory Nashorn reverse shell as the payload.

“OFBiz is not widely well-liked, but it has been exploited in the past. There is a reasonable offer of buzz about CVE-2023-51467 but no community weaponized payload, which known as into query if it was even possible,” Baines mentioned. “We have concluded that not only is it feasible, but we can achieve arbitrary in memory code execution.”

Observed this posting interesting? Stick to us on Twitter  and LinkedIn to browse far more special information we publish.

Some pieces of this report are sourced from:
thehackernews.com