Beware Apache OfBiz Vulnerability Exploit Threatening ERP Systems

January 11, 2024
1 min read

The recently disclosed critical vulnerability in the Apache OfBiz open-source ERP system, CVE-2023-51467, has been exploited by threat actors attempting to execute a memory-resident payload. While the vulnerability has been fixed in the latest version of Apache OfBiz, the exploit allows threat actors to execute a payload directly from memory without leaving traces of malicious activity. Other vulnerabilities in Apache OfBiz have been exploited in the past, demonstrating its attractiveness to attackers. The Groovy sandbox erected to block attempts to upload arbitrary web shells or run Java code via the endpoint is incomplete, allowing attackers to run curl commands and obtain a bash reverse shell on Linux systems. However, a proof-of-concept (PoC) exploit code has been developed by cybersecurity researchers that successfully achieves arbitrary in memory code execution. The code is a cross-platform solution that works on both Windows and Linux and gets around the denylist by taking advantage of groovy.util.Eval functions to launch an in-memory Nashorn reverse shell as the payload. This exploit highlights the importance of promptly applying security patches and updates to ERP systems to mitigate the risk of exploitation.

Latest from Blog

Top 3 Cybersecurity Stocks for May 2024 Buy Now

TLDR: Key Points: Cybersecurity stocks are using AI to enhance their platforms Top cybersecurity stocks to buy now include Crowdstrike, Fortinet, and Palo Alto Networks Article Summary: The cybersecurity market is booming

Get Secure: Know the Basics of Cloud Security Fundamentals Now

TLDR: Cloud security fundamentals are essential for data protection, regulatory compliance, and access management in a cloud environment. Key fundamentals include identifying assets, implementing security controls, conducting risk assessments, managing user access