In a recent development, cybersecurity researchers have uncovered a critical flaw in the Apache OfBiz open-source Enterprise Resource Planning (ERP) system. Exploiting this vulnerability, threat actors can execute a memory-resident payload. This article explores the details of this flaw, its severity, patch updates, and exploitation attempts observed in recent times.
Vulnerability Overview
The vulnerability in question is identified as CVE-2023-51467, which has been assigned a CVSS score of 9.8, denoting its severity. Notably, this flaw serves as a bypass for another severe vulnerability (CVE-2023-49070) in Apache OfBiz, which can be weaponized to bypass authentication and execute arbitrary code remotely.
Patch and Exploitation Attempts
While the Apache OFBiz version 18.12.11 released last month addresses the vulnerability, threat actors have been observed attempting to exploit the flaw on vulnerable instances. This highlights the urgency and importance of promptly implementing the patch to mitigate potential risks.
Memory-Resident Payload
The latest findings from the cybersecurity organization VulnCheck reveal that CVE-2023-51467 allows for the execution of a payload directly from the system’s memory. This execution method leaves behind minimal traces of malicious activity, making it even more challenging to detect and mitigate.
Past Exploitations and Associations
Apache OFBiz has previously faced security flaws, such as CVE-2020-9496, that have been exploited by threat actors. Notably, threat actors associated with the Sysrv botnet have leveraged these vulnerabilities to carry out their malicious activities. These instances highlight the crucial significance of addressing and securing vulnerabilities promptly to prevent exploitation.
Exploitation attempts of other bugs
Apart from CVE-2023-51467, another three-year-old bug in Apache OFBiz, identified as CVE-2021-29200, has witnessed recent exploitation attempts. Data from GreyNoise indicates that 29 unique IP addresses have been involved in these attempts over the past 30 days. This highlights the ongoing threat landscape surrounding the ERP system and the urgency to address vulnerabilities.
Emerging Details and Proof of Concept
Further investigations into CVE-2023-51467 have revealed details about a remote code execution endpoint (“/webtools/control/ProgramExport”) that exposes the system to potential attacks. Additionally, proof-of-concept (PoC) samples for command execution emerged shortly after the public disclosure of the vulnerability. Notably, the incomplete nature of the sandbox allows an attacker to run curl commands and obtain a bash reverse shell on Linux systems, further underscoring the severity of the flaw.
Cross-Platform Exploit and In-Memory Nashorn Reverse Shell
To exploit this vulnerability effectively, VulnCheck has developed a cross-platform Go-based exploit. This exploit is capable of running on both Windows and Linux systems, effectively bypassing denylists. Leveraging groovy.util.Eval functions, the exploit launches an in-memory Nashorn reverse shell as the payload. This innovative approach allows for arbitrary in-memory code execution, amplifying the potential impact threat actors can have on targeted systems.
Achieving Arbitrary In-Memory Code Execution
Through their research and PoC development, VulnCheck has concluded that arbitrary in-memory code execution is not only possible but achievable. This highlights the critical nature of promptly patching and securing the Apache OfBiz ERP system to prevent unauthorized access, data breaches, and potential further damage caused by threat actors.
The recent critical flaw discovered in the Apache OfBiz ERP system serves as a stark reminder of the importance of cybersecurity vigilance and timely patching. The memory-resident payload execution capability of CVE-2023-51467 poses a significant threat, as demonstrated by the exploitation attempts observed by VulnCheck and previous incidents with related vulnerabilities. It is imperative for organizations utilizing Apache OfBiz to promptly apply the necessary patches and stay updated with the latest security measures to defend against potential cyberattacks.