Groppoxx GitHub avatar

CVE-2024-36104-PoC

Groppoxx

Proof-of-concept exploit for CVE-2024-36104, an unauthenticated remote code execution vulnerability in Apache OFBiz before 18.12.14.

Stars

3

7-day growth

No data

Forks

0

Open issues

0

License

MIT

Last updated

2026-07-29

AI repository intelligence
FR-AI / ANALYSIS

Why it is worth attention

Provides a clear, functional script that demonstrates a critical unauthenticated RCE via path traversal and Groovy execution, with detailed technical explanation and customizable options.

Who it is for

  • Security researchers
  • Penetration testers
  • Apache OFBiz administrators
  • Red team members

Use cases

  • Verifying CVE-2024-36104 on test instances
  • Demonstrating path traversal and Groovy RCE to management
  • Assessing patch compliance in OFBiz environments
  • Security training and capture-the-flag exercises

Strengths

  • Clear documentation of vulnerability mechanics and exploitation steps
  • Support for customization via optional flags (e.g., host header, views, obfuscation)
  • Minimal dependencies and simple usage with Python 3.8+
  • Includes obfuscation option to evade basic WAF signatures

Considerations

  • Only targets Apache OFBiz versions before 18.12.14
  • Exploit may be blocked by modern WAFs despite obfuscation
  • Command output extraction relies on parsing HTML error responses from the server

README quick start

Quick Start

Description

PoC for CVE-2024-36104 — unauthenticated Groovy RCE in Apache OFBiz (<18.12.14) via /%2e/%2e/ view path traversal to ProgramExport

Related repositories

Similar projects matched by category, topics, and programming language.

lopopolo
Featured
lopopolo GitHub avatar

harness-engineering

Harness Engineering is a methodology for improving coding agent outputs by carefully crafting the environment around them—providing curated context, tools, and executable constraints that encode an organization’s nonfunctional requirements and cumulative lessons.

AI & Machine LearningAI Agents
2,390
slvDev
Featured
slvDev GitHub avatar

esp32-ai

A 28.9 million parameter language model runs on an $8 ESP32-S3 microcontroller entirely on-device, generating simple stories at about 9.5 tokens per second.

AI & Machine LearningLarge Language Models
1,960
littledivy
Featured
littledivy GitHub avatar

mimic

mimic captures traffic from any iOS or web app and automatically generates a Python client library that lets you call the app's API like a regular library.

AI & Machine Learning
1,482