ofbiz目录遍历致代码执行漏洞（CVE-2024-32113）分析

目录遍历致代码执行漏洞（CVE-2024-32113）分析

0x01 漏洞介绍

Apache OFBiz是一个电子商务平台，用于构建大中型企业级、跨平台、跨数据库、跨应用服务器的多层、分布式电子商务类应用系统。2024年5月，官方发布新版本修复了CVE-2024-32113 Apache OFBiz 目录遍历致代码执行漏洞，攻击者可构造恶意请求控制服务器。建议尽快修复漏洞。

0X02 Groovy执行分析

/framework/webtools/webapp/webtools/WEB-INF/controller.xml

412-416行

<request-map uri="ProgramExport">
        <security https="true" auth="true"/>
        <response name="success" type="view" value="ProgramExport"/>
        <response name="error" type="view" value="ProgramExport"/>
    </request-map>

可以看到是view类型

652行写着对应配置位置

<view-map name="ProgramExport" type="screen" page="component://webtools/widget/EntityScreens.xml#ProgramExport"/>

apache-ofbiz-18.12.11/framework/webtools/widget/EntityScreens.xml

74-96行

<screen name="ProgramExport">
        <section>
            <actions>
                <set field="titleProperty" value="PageTitleEntityExportAll"/>
                <set field="tabButtonItem" value="programExport"/>
                <script location="component://webtools/groovyScripts/entity/ProgramExport.groovy"/>
            </actions>
            <widgets>
                <decorator-screen name="CommonImportExportDecorator" location="${parameters.mainDecoratorLocation}">
                    <decorator-section name="body">
                         <screenlet>
                            <include-form name="ProgramExport" location="component://webtools/widget/MiscForms.xml"/>
                        </screenlet>
                        <screenlet>
                            <platform-specific>
                                <html><html-template location="component://webtools/template/entity/ProgramExport.ftl"/></html>
                            </platform-specific>
                        </screenlet>
                    </decorator-section>
                </decorator-screen>
            </widgets>
        </section>
    </screen>

可以看见调用了

/webtools/groovyScripts/entity/ProgramExport.groovy

56-82行

parameters.groovyProgram = groovyProgram
} else {
    groovyProgram = parameters.groovyProgram
}

// Add imports for script.
def importCustomizer = new ImportCustomizer()
importCustomizer.addImport("org.apache.ofbiz.entity.GenericValue")
importCustomizer.addImport("org.apache.ofbiz.entity.model.ModelEntity")
def configuration = new CompilerConfiguration()
configuration.addCompilationCustomizers(importCustomizer)

Binding binding = new Binding()
binding.setVariable("delegator", delegator)
binding.setVariable("recordValues", recordValues)

ClassLoader loader = Thread.currentThread().getContextClassLoader()
def shell = new GroovyShell(loader, binding, configuration)
  if (UtilValidate.isNotEmpty(groovyProgram)) {
    try {
        // Check if a webshell is not uploaded but allow "import"
        if (!SecuredUpload.isValidText(groovyProgram, ["import"])) {
            logError("================== Not executed for security reason ==================")
            request.setAttribute("_ERROR_MESSAGE_", "Not executed for security reason")
            return
        }