cbcvebase.
CVE-2018-8033
published 2018-12-13

CVE-2018-8033: In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the…

PriorityP263high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
25.74%
97.8th percentile
In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitation occurs by having DOCTYPEs pointing to external references that trigger a payload that returns secret information from the host.

Affected

3 ranges
VendorProductVersion rangeFixed in
apacheofbiz——
apacheofbiz16.11.01 – 16.11.04—
apache_software_foundationapache_ofbiz——

Detection & IOCsextracted from sources · hover to see the quote

url/webtools/control/httpService↗
commandPOST /webtools/control/httpService HTTP/1.1
  • →Exploit requests target the /webtools/control/httpService endpoint via both POST and GET methods with parameters: serviceName, serviceMode, and serviceContext containing XXE payloads (DOCTYPE with external entity references) ↗
  • →Shodan/FOFA fingerprinting for exposed OFBiz instances: look for HTTP response body containing 'ofbiz' or the cookie 'ofbiz.visitor=' to identify attack surface
  • ·Vulnerability affects Apache OFBiz versions 16.11.01 through 16.11.04 only; fixed in 16.11.05 ↗

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_apache7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.