CVE-2024-36104
CRITICAL EXPLOITED NUCLEIApache OFBiz <18.12.14 - Path Traversal
Title source: llmExploitation Summary
CVE-2024-36104 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including Mr-xn, ggfzx. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains a functional proof-of-concept exploit for CVE-2024-32113, demonstrating a path traversal vulnerability in Apache OFBiz leading to remote code execution (RCE). The exploit leverages a crafted HTTP POST request to execute arbitrary commands via Groovy script injection.
Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.
Exploits (2)
The repository contains a functional proof-of-concept exploit for CVE-2024-32113, demonstrating a path traversal vulnerability in Apache OFBiz leading to remote code execution (RCE). The exploit leverages a crafted HTTP POST request to execute arbitrary commands via Groovy script injection.
The repository lacks actual exploit code and only provides a README with generic usage instructions and a screenshot. It does not include technical details about the vulnerability or functional exploit code.
Nuclei Templates (1)
http.title:"ofbiz" || http.html:"apache ofbiz" || http.html:"ofbiz" || ofbiz.visitor=
app="apache_ofbiz" || body="apache ofbiz" || title="ofbiz"
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N