Critical Pre-Authentication RCE Issues in Apache OFBiz (2024)
Throughout 2024, Apache OFBiz was affected by a series of critical vulnerabilities that allowed unauthenticated remote code execution. Several of these (including CVE-2024-38856 and CVE-2024-45195) stemmed from incomplete authorization checks and path-traversal issues in the application’s controller and view mapping. Patches for earlier issues were later found to be incomplete, requiring further updates.
What organizations should know
OFBiz is used in a variety of enterprise resource planning and e-commerce environments. Because the flaws were pre-authentication, any internet-exposed instance running an affected version was at risk. Fixed versions were released in the 18.12.15 and 18.12.16 lines.
Recommendations
- Upgrade Apache OFBiz to 18.12.16 or later.
- If an immediate upgrade is not possible, restrict network access to the application to trusted networks only.
- Review access logs for suspicious activity prior to patching.
This post is for awareness only and does not include exploit details.