# Weaponizing Apache OFBiz CVE-2023-51467

DevFeed: [Weaponizing Apache OFBiz CVE-2023-51467](<https://devfeed.tech/articles/weaponizing-apache-ofbiz-cve-2023-51467-91555.md>)

Original publisher: [Read original article](<https://www.vulncheck.com/blog/ofbiz-cve-2023-51467>)

Author: Jacob Baines

Published: 2024-01-11T00:00:00Z

Content type: article

Language: en

Sources: [VulnCheck](<https://devfeed.tech/sources/vulncheck.md>)

Topics: [Groovy](<https://devfeed.tech/topics/groovy.md>)

Tags: [2020](<https://devfeed.tech/tags/2020.md>), [2021](<https://devfeed.tech/tags/2021.md>), [2023](<https://devfeed.tech/tags/2023.md>), [about](<https://devfeed.tech/tags/about.md>), [account](<https://devfeed.tech/tags/account.md>), [advanced](<https://devfeed.tech/tags/advanced.md>), [alert](<https://devfeed.tech/tags/alert.md>), [all](<https://devfeed.tech/tags/all.md>), [also](<https://devfeed.tech/tags/also.md>), [apache](<https://devfeed.tech/tags/apache.md>), [arm64](<https://devfeed.tech/tags/arm64.md>), [attack](<https://devfeed.tech/tags/attack.md>), [cve](<https://devfeed.tech/tags/cve.md>), [groovy](<https://devfeed.tech/tags/groovy.md>), [memory](<https://devfeed.tech/tags/memory.md>), [reverse](<https://devfeed.tech/tags/reverse.md>), [sandbox](<https://devfeed.tech/tags/sandbox.md>), [shell](<https://devfeed.tech/tags/shell.md>), [vulncheck](<https://devfeed.tech/tags/vulncheck.md>), [weaponizing](<https://devfeed.tech/tags/weaponizing.md>)

## AI overview

The article demonstrates arbitrary code execution through Apache OFBiz CVE-2023-51467: the authentication bypass reaches `/webtools/control/ProgramExport`, where a Groovy blocklist is meant to restrict submitted code. Disk-based payloads can use `curl` or launch a Bash reverse shell, but are less portable and touch disk. For a cross-platform, memory-resident shell, the authors evade blocked terms by splitting strings and recombining them through Groovy `Eval`, then use Nashorn to run a reverse-shell payload that detects Windows or Linux. The exploit is not subtle on the wire, and shell commands spawn processes; the authors note TLS may reduce network detection visibility when traffic is not decrypted. They report publishing an exploit built with go-exploit.

## Source excerpt

VulnCheck bypasses the Apache OFBiz Groovy sandbox to land a memory resident reverse shell.