cve/2018/CVE-2018-8033.md

CVE-2018-8033

Description

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitation occurs by having DOCTYPEs pointing to external references that trigger a payload that returns secret information from the host.

POC

Reference

No PoCs from references.

Github

• https://github.com/20142995/Goby
• https://github.com/ARPSyndicate/cvemon
• https://github.com/ARPSyndicate/kenzer-templates
• https://github.com/Cappricio-Securities/CVE-2018-8033
• https://github.com/Elsfa7-110/kenzer-templates
• https://github.com/HimmelAward/Goby_POC
• https://github.com/Z0fhack/Goby_POC
• https://github.com/amcai/myscan
• https://github.com/jamieparfet/Apache-OFBiz-XXE
• https://github.com/merlinepedra/nuclei-templates
• https://github.com/sobinge/nuclei-templates