> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# CVE-2024-38856 - Apache OFBiz RCE Scanner & Exploit Released
- URL: https://darkwebinformer.com/cve-2024-38856-apache-ofbiz-rce-scanner-exploit/
- Published: 2024-08-08T15:00:17.000Z
- Updated: 2025-09-04T22:27:57.000Z
- Author: Dark Web Informer
- Tags: Vulnerabilities

[GitHub - securelayer7/CVE-2024-38856\_Scanner: Apache OFBiz RCE Scanner & Exploit (CVE-2024-38856)Apache OFBiz RCE Scanner & Exploit (CVE-2024-38856) - securelayer7/CVE-2024-38856\_Scanner![](https://github.githubassets.com/assets/pinned-octocat-093da3e6fa40.svg)GitHubsecurelayer7![](https://opengraph.githubassets.com/62c2cf0323ada116509f4b9265d36c1847472c9d2fd4d3247c5a9d734ca83771/securelayer7/CVE-2024-38856_Scanner)](https://github.com/securelayer7/CVE-2024-38856%5FScanner)

 For Ethical Usage only, Any harmful or malicious activities are not allowed. And it's your own responsibility.

CVE-2024-38856: Apache OFBiz remote code execution Scanner & Exploit

- This issue affects Apache OFBiz: through 18.12.14

# Usage

[](https://github.com/securelayer7/CVE-2024-38856%5FScanner#usage)

```

 ██████╗██╗   ██╗███████╗    ██████╗  ██████╗ ██████╗ ██╗  ██╗     ██████╗  █████╗  █████╗ ███████╗ ██████╗ 
██╔════╝██║   ██║██╔════╝    ╚════██╗██╔═████╗╚════██╗██║  ██║     ╚════██╗██╔══██╗██╔══██╗██╔════╝██╔════╝ 
██║     ██║   ██║█████╗█████╗ █████╔╝██║██╔██║ █████╔╝███████║█████╗█████╔╝╚█████╔╝╚█████╔╝███████╗███████╗ 
██║     ╚██╗ ██╔╝██╔══╝╚════╝██╔═══╝ ████╔╝██║██╔═══╝ ╚════██║╚════╝╚═══██╗██╔══██╗██╔══██╗╚════██║██╔═══██╗
╚██████╗ ╚████╔╝ ███████╗    ███████╗╚██████╔╝███████╗     ██║     ██████╔╝╚█████╔╝╚█████╔╝███████║╚██████╔╝
 ╚═════╝  ╚═══╝  ╚══════╝    ╚══════╝ ╚═════╝ ╚══════╝     ╚═╝     ╚═════╝  ╚════╝  ╚════╝ ╚══════╝ ╚═════╝ 
                                                                                                                                                           
                                                                                                                                                              
                    Github: https://github.com/securelayer7/CVE-2024-38856_Scanner
                                By: Securelayer7(yosef0x01 & Zeyad Azima)                                     

usage: cve-2024-38856_Scanner.py [-h] [-t TARGET] [-p PORT] [-c COMMAND] [-s] [-d DOMAIN] [-f FILE]

CVE-2024-38856 Apach Ofbiz RCE Scanners.

options:
  -h, --help            show this help message and exit
  -t TARGET, --target TARGET
                        Target host
  -p PORT, --port PORT  Target port
  -c COMMAND, --command COMMAND
                        Command to execute
  -s, --scan            Perform scan with ping, curl, and wget
  -d DOMAIN, --domain DOMAIN
                        Domain (attacker domain) to scan with ping, curl, and wget
  -f FILE, --file FILE  File containing a list of targets in the format http(s)://target,port

```

## Arguments

[](https://github.com/securelayer7/CVE-2024-38856%5FScanner#arguments)

- `-t, --target <host>`: Specifies the target host. This cannot be used with the `--file` option.
- `-p, --port <port>`: Specifies the target port. Also, this option is required if the port is not specified in the targets file.
- `-c, --command <command>`: Specifies the command to execute on the target.
- `-s, --scan`: Enables scan mode. When this option is used, the script will perform a series of predefined commands (`ping`, `curl`, `wget`) on the specified domain.
- `-d, --domain <domain>`: Specifies your domain (attacker domain) to use in the scan with `ping`, `curl`, and `wget` commands. This option must be used with `--scan`.
- `-f, --file <file>`: Specifies a file containing a list of targets in the format `http(s)://target,port`. This option cannot be used with `--target`.

`Global Port`: When scanning targets file, You can exclude `,port` and use `-p` to set a global port for all targets.

## Single Target

[](https://github.com/securelayer7/CVE-2024-38856%5FScanner#single-target)

- Normal Mode

python cve-2024-38856\_Scanner.py -t <target> -p <port> -c "command"

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2024/08/7327411.png)

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2024/08/8248991.png)

![](https://storage.ghost.io/c/6b/16/6b16ac9c-cd67-432f-b0f3-bbec941084ff/content/images/2024/08/43568282.png)