{"id":1076786,"date":"2023-12-27T15:11:18","date_gmt":"2023-12-27T17:11:18","guid":{"rendered":"https:\/\/teknomers.com\/fr\/un-zero-day-critique-dans-le-systeme-erp-apache-ofbiz-expose-les-entreprises-a-des-attaques\/"},"modified":"2023-12-27T15:11:22","modified_gmt":"2023-12-27T17:11:22","slug":"un-zero-day-critique-dans-le-systeme-erp-apache-ofbiz-expose-les-entreprises-a-des-attaques","status":"publish","type":"post","link":"https:\/\/teknomers.com\/fr\/un-zero-day-critique-dans-le-systeme-erp-apache-ofbiz-expose-les-entreprises-a-des-attaques\/","title":{"rendered":"Un Zero-Day critique dans le syst\u00e8me ERP Apache OfBiz expose les entreprises \u00e0 des attaques"},"content":{"rendered":"<p> <br \/>\n<\/p>\n<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">27 d\u00e9cembre 2023<\/span><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">R\u00e9daction<\/span><\/span><span class=\"p-tags\">Zero-Day \/ Vuln\u00e9rabilit\u00e9<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a rel=\"nofollow\" href=\"https:\/\/teknomers.com\/fr\/wp-content\/uploads\/2023\/12\/Un-Zero-Day-critique-dans-le-systeme-ERP-Apache-OfBiz-expose.jpg\" style=\"clear: left; display: block; float: left; text-align: center;\"><\/a><\/div>\n<p>Une nouvelle faille de s\u00e9curit\u00e9 Zero Day a \u00e9t\u00e9 d\u00e9couverte dans Apache OfBiz, un syst\u00e8me ERP (Enterprise Resource Planning) open source qui pourrait \u00eatre exploit\u00e9e pour contourner les protections d&#8217;authentification.<\/p>\n<p>La vuln\u00e9rabilit\u00e9, suivie comme <a rel=\"nofollow noopener\" class=\"editor-rtfLink\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-51467\" target=\"_blank\"><strong>CVE-2023-51467<\/strong><\/a>r\u00e9side dans la fonctionnalit\u00e9 de connexion et est le r\u00e9sultat d&#8217;un correctif incomplet pour une autre vuln\u00e9rabilit\u00e9 critique (<a rel=\"nofollow noopener\" class=\"editor-rtfLink\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-49070\" target=\"_blank\">CVE-2023-49070<\/a>score CVSS : 9,8) publi\u00e9 plus t\u00f4t ce mois-ci.<\/p>\n<p>&#8220;Le <a rel=\"nofollow noopener\" class=\"editor-rtfLink\" href=\"https:\/\/github.com\/apache\/ofbiz-framework\/commit\/c59336f604\" target=\"_blank\">mesures de s\u00e9curit\u00e9<\/a> &#8220;Le correctif CVE-2023-49070 a laiss\u00e9 le probl\u00e8me racine intact et le contournement de l&#8217;authentification \u00e9tait donc toujours pr\u00e9sent&#8221;, a d\u00e9clar\u00e9 l&#8217;\u00e9quipe de recherche sur les menaces de SonicWall Capture Labs, qui a d\u00e9couvert le bug, <a rel=\"nofollow noopener\" class=\"editor-rtfLink\" href=\"https:\/\/blog.sonicwall.com\/en-us\/2023\/12\/sonicwall-discovers-critical-apache-ofbiz-zero-day-authbiz\/\" target=\"_blank\">dit<\/a> dans une d\u00e9claration partag\u00e9e avec The Hacker News.<\/p>\n<div class=\"separator\" style=\"clear: both;\"><a rel=\"nofollow\" href=\"https:\/\/teknomers.com\/fr\/wp-content\/uploads\/2023\/12\/1703697078_113_Un-Zero-Day-critique-dans-le-systeme-ERP-Apache-OfBiz-expose.jpg\" style=\"clear: left; display: block; float: left; text-align: center;\"><img decoding=\"async\" src=\"https:\/\/teknomers.com\/fr\/wp-content\/uploads\/2023\/12\/1703697078_113_Un-Zero-Day-critique-dans-le-systeme-ERP-Apache-OfBiz-expose.jpg\" alt=\"Apache OfBiz ERP\" border=\"0\" data-original-height=\"440\" data-original-width=\"728\" title=\"Apache OfBiz ERP\"\/><\/a><\/div>\n<p>CVE-2023-49070 fait r\u00e9f\u00e9rence \u00e0 une faille d&#8217;ex\u00e9cution de code \u00e0 distance pr\u00e9-authentifi\u00e9e affectant les versions ant\u00e9rieures \u00e0 18.12.10 qui, lorsqu&#8217;elle est exploit\u00e9e avec succ\u00e8s, pourrait permettre aux acteurs malveillants de prendre le contr\u00f4le total du serveur et de siphonner les donn\u00e9es sensibles.  Cela est d\u00fb \u00e0 un composant XML-RPC obsol\u00e8te dans Apache OFBiz.<\/p>\n<p>Selon SonicWall, CVE-2023-51467 pourrait \u00eatre d\u00e9clench\u00e9 \u00e0 l&#8217;aide de param\u00e8tres USERNAME et PASSWORD vides et invalides dans une requ\u00eate HTTP pour renvoyer un message de r\u00e9ussite d&#8217;authentification, contournant ainsi efficacement la protection et permettant \u00e0 un acteur malveillant d&#8217;acc\u00e9der \u00e0 des ressources internes autrement non autoris\u00e9es.<\/p>\n<div class=\"check_two clear babsi\"><center class=\"cf\"><a rel=\"nofollow noopener\" href=\"https:\/\/thn.news\/pjHvTZON\" target=\"_blank\" title=\"Cybersecurity\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"La cyber-s\u00e9curit\u00e9\" src=\"https:\/\/teknomers.com\/fr\/wp-content\/uploads\/2023\/11\/Turla-met-a-jour-la-porte-derobee-Kazuar-avec-une.gif\" width=\"727\" height=\"90\"\/><\/a><\/center><\/div>\n<p>L&#8217;attaque repose sur le fait que le param\u00e8tre \u00ab requirePasswordChange \u00bb est d\u00e9fini sur \u00ab Y \u00bb (c&#8217;est-\u00e0-dire oui) dans l&#8217;URL, ce qui entra\u00eene le contournement trivial de l&#8217;authentification quelles que soient les valeurs transmises dans les champs nom d&#8217;utilisateur et mot de passe.<\/p>\n<p>&#8220;La vuln\u00e9rabilit\u00e9 permet aux attaquants de contourner l&#8217;authentification pour r\u00e9aliser une simple falsification de requ\u00eate c\u00f4t\u00e9 serveur (<a rel=\"nofollow noopener\" class=\"editor-rtfLink\" href=\"https:\/\/owasp.org\/www-community\/attacks\/Server_Side_Request_Forgery\" target=\"_blank\">SSRF<\/a>)&#8221;, selon une description de la faille dans la base de donn\u00e9es nationale sur les vuln\u00e9rabilit\u00e9s (NVD) du NIST.<\/p>\n<p>Les utilisateurs qui comptent sur Apache OFbiz pour mettre \u00e0 jour vers <a rel=\"nofollow noopener\" class=\"editor-rtfLink\" href=\"https:\/\/ofbiz.apache.org\/security.html\" target=\"_blank\">version 18.12.11<\/a> ou plus tard d\u00e8s que possible pour att\u00e9nuer toute menace potentielle.<\/p>\n<p><\/p>\n<div class=\"cf note-b\">Vous avez trouv\u00e9 cet article int\u00e9ressant ?  Suivez-nous sur <a rel=\"nofollow noopener\" href=\"https:\/\/twitter.com\/thehackersnews\" target=\"_blank\">Twitter <i class=\"icon-font icon-twitter\">\uf099<\/i><\/a>  et <a rel=\"nofollow noopener\" href=\"https:\/\/www.linkedin.com\/company\/thehackernews\/\" target=\"_blank\">LinkedIn<\/a> pour lire plus de contenu exclusif que nous publions.<\/div>\n<\/div>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><br \/>\n<br \/><br \/>\n<br \/><a href=\"https:\/\/thehackernews.com\/2023\/12\/critical-zero-day-in-apache-ofbiz-erp.html\" rel=\"nofollow noopener\" target=\"_blank\">ttn-fr-57<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\ue80227 d\u00e9cembre 2023\ue804R\u00e9dactionZero-Day \/ Vuln\u00e9rabilit\u00e9 Une nouvelle faille de s\u00e9curit\u00e9 Zero Day a \u00e9t\u00e9 d\u00e9couverte dans Apache OfBiz, un syst\u00e8me ERP (Enterprise Resource Planning) open source qui pourrait \u00eatre exploit\u00e9e pour contourner les protections d&#8217;authentification. La vuln\u00e9rabilit\u00e9, suivie comme CVE-2023-51467r\u00e9side dans la fonctionnalit\u00e9 de connexion et est le r\u00e9sultat d&#8217;un correctif incomplet pour une autre [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":1076787,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[200292,43333,8074,4168,22,4165,4161,200267,429,133,3244,74589,16209,4159,4171,65,200271,200268,200269,200270,221841,128318,4172,4169,2622,4166,4164,35759],"class_list":["post-1076786","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technologie","tag-actualites-sur-la-cybersecurite","tag-apache","tag-attaques","tag-comment-pirater","tag-critique","tag-cyber-attaques","tag-cyber-mises-a-jour","tag-cyberactualites","tag-dans","tag-des","tag-entreprises","tag-erp","tag-expose","tag-lactualite-de-la-cybersecurite-aujourdhui","tag-lactualite-des-hackers","tag-les","tag-logiciel-malveillant-rancongiciel","tag-mises-a-jour-sur-la-cybersecurite","tag-nouvelles-des-pirates","tag-nouvelles-sur-le-piratage","tag-ofbiz","tag-securite-des-informations","tag-securite-informatique","tag-securite-internet","tag-systeme","tag-violation-de-donnees","tag-vulnerabilite-logicielle","tag-zeroday"],"_links":{"self":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts\/1076786","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/comments?post=1076786"}],"version-history":[{"count":0,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/posts\/1076786\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/media\/1076787"}],"wp:attachment":[{"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/media?parent=1076786"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/categories?post=1076786"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/teknomers.com\/fr\/wp-json\/wp\/v2\/tags?post=1076786"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}