Pre-auth RCE in Apache OFBiz XML-RPC

This repository contains a single Metasploit module (modules/exploits/linux/http/apache_ofbiz_deserialization.rb) that exploits a Java deserialization vulnerability in Apache OFBiz's XML-RPC endpoint. The exploit targets the /webtools/control/xmlrpc endpoint, which is accessible over HTTP(S), and leverages unauthenticated or authentication-bypassed access to achieve remote code execution. The module supports multiple payloads, including command execution and Meterpreter reverse shells, and automatically selects the appropriate gadget chain (ROME or CommonsBeanutils1) based on the detected OFBiz version. The exploit is weaponized, allowing for easy payload customization and reliable exploitation. The module references several CVEs (CVE-2020-9496, CVE-2023-49070, CVE-2023-51467) and is suitable for targeting vulnerable Apache OFBiz installations on Linux platforms.

This repository contains a Python exploit (exploit.py) and a README.md for Apache OFBiz vulnerabilities CVE-2023-49070 and CVE-2023-51467. The exploit targets Apache OFBiz versions 18.12.10 and below, leveraging a pre-authentication RCE via a vulnerable XML-RPC endpoint. The script first checks if the target is vulnerable by sending a request to the /webtools/control/ping endpoint and looking for a 'PONG' response. If vulnerable, it prompts the user for their IP and port, then uses ysoserial-all.jar to generate a Java deserialization payload that executes a base64-encoded bash reverse shell. This payload is sent to the /webtools/control/xmlrpc endpoint, which, if successful, results in a reverse shell connection to the attacker's machine. The exploit requires the ysoserial-all.jar file and Java to be present on the attacker's system. The repository is structured simply, with the main logic in exploit.py and usage/documentation in README.md.

This repository is a Java-based GUI tool (OFBiz-Attack) designed to exploit two vulnerabilities in Apache OFBiz: CVE-2023-49070 (XML-RPC deserialization) and CVE-2023-51467 (authentication bypass/command execution). The tool is structured as a desktop application with three main modules: vulnerability detection, command execution, and memory shell (webshell) injection. The detection module verifies if the target is vulnerable by sending crafted HTTPS requests to specific OFBiz endpoints. The command execution module leverages CVE-2023-51467 to run arbitrary system commands on the target via a Groovy shell, returning the output to the user. The memory shell injection module uses CVE-2023-49070 to inject either a custom command shell or a Behinder shell into the target's /webtools/* filter, providing persistent access. The codebase is organized into listeners for each module, utility classes for HTTP requests and vulnerability checks, and a main GUI class. The tool is operational, providing both detection and exploitation capabilities, and is intended for use against vulnerable Apache OFBiz instances accessible over HTTPS.

This repository contains a Python proof-of-concept exploit for CVE-2023-49070, a pre-authentication remote code execution vulnerability in Apache OFBiz versions prior to 18.12.10. The exploit leverages a Java XML-RPC deserialization flaw by sending a malicious, base64-encoded Java serialized object (generated using ysoserial) to the vulnerable XML-RPC endpoint. The exploit supports three modes: (1) arbitrary command execution (RCE), (2) DNS-based out-of-band verification (DNS), and (3) spawning a reverse shell to an attacker-controlled host (shell). The main exploit logic is in 'exploit.py', which requires the ysoserial-all.jar tool and Java 11+ to generate the payloads. The README provides usage instructions, references, and context. The only network endpoint targeted is the OFBiz XML-RPC interface, and the exploit is operational, providing real RCE if the target is vulnerable and properly configured.

This repository provides an operational exploit and detection script for two critical authentication bypass vulnerabilities in Apache OFBiz (CVE-2023-51467 and CVE-2023-49070). The main exploit script (exploit.py) can both scan for vulnerable instances and execute arbitrary commands on a compromised server by leveraging a Java deserialization attack using ysoserial's CommonsBeanutils1 gadget. The exploit works by sending a specially crafted, base64-encoded Java serialized object to the /webtools/control/xmlrpc/ endpoint, exploiting the authentication bypass to achieve remote code execution. The detection script (xdetection.py) is a simplified version that only checks for vulnerability by probing the /webtools/control/ping endpoint. The repository is structured with clear separation between exploitation and detection, and requires the ysoserial-all.jar file for payload generation. The exploit targets Apache OFBiz instances accessible over HTTP/HTTPS and does not require authentication due to the nature of the vulnerabilities.

This repository provides a proof-of-concept (PoC) exploit for CVE-2023-49070, a pre-authentication remote code execution (RCE) vulnerability in Apache OFBiz. The main exploit script, 'CVE-2023-49070.py', is a Python script that leverages a Java deserialization vulnerability in the XML-RPC endpoint of OFBiz. The script requires the ysoserial tool to generate a malicious Java serialized object (using the URLDNS gadget), which is then base64-encoded and embedded in an XML-RPC request. The crafted request is sent to the vulnerable endpoint, and if successful, the target server will make a DNS request to an attacker-controlled domain, demonstrating code execution. The repository also includes a README with usage instructions and a LICENSE file. The exploit is a PoC and does not provide a full shell or arbitrary command execution, but demonstrates the vulnerability via DNS exfiltration. No hardcoded IPs or domains are present; the attacker supplies their own collaborator domain as an argument.

This repository contains a Python exploit script (ofbiz_exploit.py) targeting authentication bypass and remote code execution vulnerabilities in Apache OFBiz versions prior to 18.12.10 (CVE-2023-49070 and CVE-2023-51467). The exploit works by sending specially crafted XML-RPC requests to the OFBiz 'webtools/control/xmlrpc' endpoint, leveraging a Java deserialization vulnerability via a payload generated by ysoserial (CommonsBeanutils1 gadget). The script supports two main actions: executing arbitrary commands (rce) and spawning a reverse shell (shell) to an attacker-controlled host. It also includes a function to check if the target is vulnerable by sending a request to the 'webtools/control/ping' endpoint. The repository consists of the main exploit script and a README with usage instructions and references. The exploit requires the ysoserial-all.jar file and Java to generate the payloads. No hardcoded IPs or domains are present, but the endpoints used are specific to the vulnerable OFBiz application.