Authenticated Groovy Code Execution in Apache OFBiz traverseContent Service

Repository contains a README plus two Bash scripts implementing a practical Apache OFBiz exploit chain. The main vulnerability is CVE-2026-47342, a privilege-escalation flaw in OFBiz where an authenticated low-privileged user with ordermgr access can reach /ordermgr/control/updateFeatures, which dispatches to the content service updateOrRemove without adequate authorization checks. By supplying entityName=UserLoginSecurityGroup and fields for userLoginId/groupId/fromDate, the exploit creates a security-group membership record and grants FULLADMIN to the attacker-controlled account. Repository structure: README.md documents the root cause, affected OFBiz files, source-to-sink trace, and mitigation ideas. create_buyer_user.sh is a helper script that logs into /webtools/control/login using hardcoded default admin credentials (admin/ofbiz), creates a test user, and assigns BUYER/ORDERPURCH permissions via entity-change endpoints. poc_fullchain.sh is the primary exploit entry point: it logs into ordermgr as the low-privileged user, posts the crafted updateFeatures request to add FULLADMIN, then logs into webtools and performs a second-stage RCE by creating a Content record and invoking /webtools/control/scheduleServiceSync with SERVICE_NAME=traverseContent and a Groovy expression in pickWhen that launches sh -c <command> and writes output to a temporary file. Capabilities: authenticated privilege escalation to FULLADMIN; helper automation for provisioning a test BUYER account; chained authenticated remote command execution when the target is also vulnerable to the referenced traverseContent/Groovy issue. The exploit is operational rather than framework-based: it uses curl, hardcoded endpoint paths, and a basic shell-command payload with limited customization through script arguments and TARGET environment variable.

This repository is a small, self-contained authenticated RCE proof-of-concept for Apache OFBiz CVE-2026-46586. It contains a detailed README describing the vulnerability and one executable Bash script, poc.sh. The exploit abuses improper validation in the traverseContent service: attacker-controlled condition parameters such as pickWhen are passed into ContentWorker.checkWhen(), where FlexibleStringExpander first expands ${groovy:...} expressions and the result is then evaluated as Groovy via JSR-223. The net effect is authenticated arbitrary code execution on the OFBiz server. Repository structure is minimal: README.md documents root cause, source-to-sink trace, affected files in OFBiz, example HTTP request, and mitigations; poc.sh automates exploitation. The script logs into OFBiz WebTools, creates a Content entity required by traverseContent, then submits a malicious request to /webtools/control/scheduleServiceSync with SERVICE_NAME=traverseContent, _RUN_SYNC_=Y, a generated contentId, and a Groovy ProcessBuilder payload in pickWhen. The payload runs sh -c <command> and tees output into /tmp/ofbiz_rce_result.txt, which the script then reads locally to confirm success. A secondary capability in poc.sh is create_test_user(), which uses authenticated entity-change endpoints to create a new user (rceuser) and assign it to the FLEXADMIN security group. This is not the core vulnerability itself, but it demonstrates post-auth administrative setup and expands exploit usability in test environments. Overall, this is a real exploit rather than a detector: it performs authenticated web requests against OFBiz administrative endpoints and delivers arbitrary shell command execution through Groovy injection in traverseContent.