CVE-2018-8033

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitation occurs by having DOCTYPEs pointing to external references that trigger a payload that returns secret information from the host.

CVSS v3.0

7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

25.74% chance of exploitation in the next 30 days, 98th percentile

Nuclei

high · CWE-200

Published

2018-12-13

Updated

2024-08-05

Proof-of-concept exploits (2)

• Cappricio-Securities/CVE-2018-80332★ · 2024-06-21
• jamieparfet/Apache-OFBiz-XXE12★ · 2018-10-16

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8033.yaml

Exploit collections (2)

• chaitin/xray/blob/master/pocs/apache-ofbiz-cve-2018-8033-xxe.yml
• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2018/CVE-2018-8033.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2000-0114
• CVE-2009-0347
• CVE-2012-5321
• CVE-2015-1635
• CVE-2015-7297
• CVE-2017-7269