CVE-2025-26865 PoC — Apache OFBiz 安全漏洞

Description

CVE-2025-26865: FreeMarker Server-Side Template Injection via the "ecommerce" plugin in Apache OfBiz

介绍

# CVE-2025-26865: FreeMarker Server-Side Template Injection via the "ecommerce" plugin in Apache OfBiz

Due to a regression between 18.12.17 and 18.12.18 the fix for finding [CVE-2022-25813: FreeMarker Server-Side Template Injection in Apache OfBiz](https://github.com/mbadanoiu/CVE-2022-25813) was no longer enforced which reopened the possibility of launching FreeMarker Server-Side Template Injection (SSTI) attacks by leveraging the "ecommerce" plugin.

If the attack is successful, the SSTI may result in Remote Code Execution (RCE).

### Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found [here](https://lists.apache.org/thread/prb48ztk01bflyyjbl6p56wlcc1n5sz7).

### Requirements:

This vulnerability requires:
<br/>
- Registering a new user or valid user credentials
- User interaction of a administrative user

### Proof Of Concept:

As this attack is a exact re-creation of CVE-2022-25813, more details and the exploitation process can be found in this [PDF](https://github.com/mbadanoiu/CVE-2022-25813/blob/main/Apache%20OfBiz%20-%20CVE-2022-25813.pdf).

### Additional Resources:

Original SSTI finding in Apache OfBiz: [CVE-2022-25813: FreeMarker Server-Side Template Injection in Apache OfBiz](https://github.com/mbadanoiu/CVE-2022-25813) 

文件快照

备注