CVE-2018-8033
published 2018-12-13CVE-2018-8033: In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the…
PriorityP180high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
25.74%
98.0th percentile
In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitation occurs by having DOCTYPEs pointing to external references that trigger a payload that returns secret information from the host.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | ofbiz | — | — |
| apache | ofbiz | 16.11.01 – 16.11.04 | — |
| apache_software_foundation | apache_ofbiz | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandPOST /webtools/control/httpService HTTP/1.1
- →Exploit requests target the /webtools/control/httpService endpoint via both POST and GET methods with parameters: serviceName, serviceMode, and serviceContext containing XXE payloads (DOCTYPE with external entity references) ↗
- →Shodan/FOFA fingerprinting for exposed OFBiz instances: look for HTTP response body containing 'ofbiz' or the cookie 'ofbiz.visitor=' to identify attack surface
- ·Vulnerability affects Apache OFBiz versions 16.11.01 through 16.11.04 only; fixed in 16.11.05 ↗
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vulncheck7.5HIGH
vendor_apache7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apache
Apache ofbiz: CVE-2018-8033
vendor_apache·CVSS 7.5
CVE-2018-8033 [HIGH] Apache ofbiz: CVE-2018-8033
Apache ofbiz: CVE-2018-8033
; affected releases: from 16.11.01 to 16.11.04; fixed in 16.11.05 with revisions 1833708 , 1836141 .
GHSA
GHSA-2v2f-rp8w-vrxh: In Apache OFBiz 16
ghsa_unreviewed·2022-05-14
CVE-2018-8033 [HIGH] CWE-200 GHSA-2v2f-rp8w-vrxh: In Apache OFBiz 16
In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitation occurs by having DOCTYPEs pointing to external references that trigger a payload that returns secret information from the host.
VulnCheck
Apache OFBiz Exposure of Sensitive Information to an Unauthorized Actor
vulncheck·2018·CVSS 7.5
CVE-2018-8033 [HIGH] Apache OFBiz Exposure of Sensitive Information to an Unauthorized Actor
Apache OFBiz Exposure of Sensitive Information to an Unauthorized Actor
In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitation occurs by having DOCTYPEs pointing to external references that trigger a payload that returns secret information from the host.
Affected: Apache OFBiz
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honey
No detection rules found.
Nuclei
Apache OFBiz - XML External Entity Injection
nuclei·CVSS 7.5
CVE-2018-8033 [HIGH] Apache OFBiz - XML External Entity Injection
Apache OFBiz - XML External Entity Injection
In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitation occurs by having DOCTYPEs pointing to external references that trigger a payload that returns secret information from the host.
Template:
id: CVE-2018-8033
info:
name: Apache OFBiz - XML External Entity Injection
author: daffainfo
severity: high
description: |
In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via
2018-12-13
Published
Exploited in the wild