cbcvebase.
CVE-2023-51467
published 2023-12-26

CVE-2023-51467: The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code

PriorityP193critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
96.00%
99.9th percentile
The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code

Affected

3 ranges
VendorProductVersion rangeFixed in
apacheofbiz< 18.12.1118.12.11
apacheofbiz
apache_software_foundationapache_ofbiz< 18.12.1118.12.11

Detection & IOCsextracted from sources · hover to see the quote

url/webtools/control/ProgramExport;/?USERNAME=&PASSWORD=&requirePasswordChange=Y
url/webtools/control/xmlrpc
cookieOFBiz.Visitor=
commandgroovyProgram=import+groovy.lang.GroovyShell%3B%0A%0AString+expression+%3D+%22'nslookup+{{interactsh-url}}'.execute()%22%3B%0AGroovyShell+gs+%3D+new+GroovyShell()%3B%0Ags.evaluate(expression)%3B
versionApache OFBiz < 18.12.11
  • Detect authentication bypass attempts via the requirePasswordChange=Y parameter in POST requests to /webtools/control/ProgramExport
  • Monitor for POST requests to /webtools/control/ProgramExport with empty USERNAME and PASSWORD fields combined with requirePasswordChange=Y as an auth bypass indicator
  • Detect Groovy code execution payloads (groovyProgram parameter) in HTTP request bodies targeting OFBiz endpoints, indicating RCE exploitation
  • Use Shodan/FOFA queries to identify exposed OFBiz instances: html:"OFBiz", http.html:"ofbiz", ofbiz.visitor= (Shodan); app="Apache_OFBiz", body="ofbiz" (FOFA)
  • Exploitation of CVE-2023-51467 leverages the CommonsBeanutils1 gadget chain for deserialization on OFBiz versions up to 18.12.11; monitor for Java deserialization payloads on OFBiz HTTP endpoints
  • Threat actors scanning for CVE-2023-51467 are specifically targeting Confluence servers; correlate OFBiz exploit attempts with subsequent Confluence-related network activity
  • DNS callback to oast.online observed in active exploitation scans; monitor outbound DNS/HTTP from OFBiz servers to oast.online as an indicator of compromise
  • ·CVE-2023-51467 is a bypass of the incomplete fix for CVE-2023-49070; systems patched to OFBiz 18.12.10 (which fixed CVE-2023-49070) remain vulnerable and must upgrade to 18.12.11
  • ·OFBiz is embedded in Atlassian JIRA (used by 120,000+ companies); JIRA deployments inherit this vulnerability and must also be assessed
  • ·Public PoC exploits are widely available for this CVE, significantly lowering the bar for exploitation; treat all unpatched OFBiz instances as actively targeted

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
vendor_apache9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.