Apache OFBiz 18.12.09 Remote Code Execution ≈ Packet Storm

Roger Wilco Exploits 29 décembre 2023 Affichages : 74

Home ^[1] Files ^[2] News ^[3] &[SERVICES_TAB] Contact ^[4] Add New ^[5]

Apache OFBiz 18.12.09 Remote Code Execution^[6]: Authored by Jacques Leroux ^[7]; Apache OFBiz version 18.12.09 suffers from a pre-authentication remote code execution vulnerability.; advisories | CVE-2023-49070 ^[8]; SHA-256 | eb4458f535e94d51c6b4bf1779dd9da7aa903e2ad0a85e32eb0811983d7d8aaa; Download ^[9] | Favorite ^[10] | View ^[11]

        From: Jacques Le Roux <jleroux () apache org>
Date: Mon, 04 Dec 2023 21:04:50 +0000
Severity: moderate
Affected versions:
- Apache OFBiz before 18.12.10
Description:
Pre-auth RCE in Apache Ofbiz 18.12.09.
It's due to XML-RPC no longer maintained still present.
This issue affects Apache OFBiz: before 18.12.10. 
Users are recommended to upgrade to version 18.12.10
This issue is being tracked as OFBIZ-12812 
Credit:
Siebene@ (finder)
References:
https://ofbiz.apache.org/download.html
https://ofbiz.apache.org/security.html
https://ofbiz.apache.org/release-notes-18.12.10.html
https://ofbiz.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-49070
https://issues.apache.org/jira/browse/OFBIZ-12812
-----
Packet Storm Note
Below is the proof of concept circulating on twitter:
#POC: 
/webtools/control/xmlrpc;/?USERNAME=&PASSWORD=s&requirePasswordChange=Y