Apache has recently patched a critical security vulnerability in its open-source OFBiz (Open For Business) software, which posed a severe risk by allowing attackers to execute arbitrary code on both Linux and Windows servers. OFBiz is a comprehensive suite of customer relationship management (CRM) and enterprise resource planning (ERP) applications that also serves as a Java-based web framework for developing various web applications. The vulnerability, tracked as CVE-2024-45195, was discovered by security researchers at Rapid7 and stemmed from a forced browsing flaw that exposed restricted paths, making them vulnerable to unauthenticated direct request attacks.
The Root of the Vulnerability
The vulnerability in question, CVE-2024-45195, was caused by missing view authorization checks in the OFBiz web application, which allowed attackers without valid credentials to execute arbitrary code on the server. Ryan Emmons, a security researcher from Rapid7, elaborated on the flaw in a report released on Thursday, which included proof-of-concept exploit code to demonstrate how the vulnerability could be exploited.
In response, Apache’s security team acted swiftly, addressing the vulnerability in version 18.12.16 of OFBiz by implementing necessary authorization checks. Users of OFBiz are strongly advised to update their installations immediately to safeguard against potential exploits targeting this vulnerability.
A History of Security Patches and Bypasses
What makes CVE-2024-45195 particularly concerning is that it is a bypass for previous security patches related to three other OFBiz vulnerabilities identified earlier in the year. These vulnerabilities, tracked as CVE-2024-32113, CVE-2024-36104, and CVE-2024-38856, all share a common root cause—controller-view map fragmentation. This issue permits attackers to execute unauthorized code or SQL queries, potentially leading to remote code execution without the need for authentication.
Emmons highlighted in his report that despite the patches applied earlier this year, the fundamental issue remained unresolved, allowing for the continued exploitation of OFBiz installations. This revelation underscores the importance of thorough testing and validation of security patches to ensure that vulnerabilities are completely mitigated.
CISA’s Involvement and Wider Implications
In early August, the Cybersecurity and Infrastructure Security Agency (CISA) issued a warning regarding the CVE-2024-32113 OFBiz vulnerability, which had been patched in May but was still being actively exploited in attacks. This warning followed technical details published by SonicWall researchers on the CVE-2024-38856 pre-authentication remote code execution bug, which further highlighted the urgency of addressing these security issues.
CISA’s involvement extended beyond just issuing warnings; the agency also added the two aforementioned security bugs to its catalog of actively exploited vulnerabilities. This move required federal agencies to patch their servers within three weeks, as mandated by the binding operational directive (BOD 22-01) issued in November 2021. Although BOD 22-01 primarily targets Federal Civilian Executive Branch (FCEB) agencies, CISA strongly encouraged all organizations, regardless of their affiliation, to prioritize patching these flaws to prevent potential attacks on their networks.
The Broader Context of OFBiz Exploits
The vulnerabilities within OFBiz are not isolated incidents. In December, attackers began exploiting another pre-authentication remote code execution vulnerability, CVE-2023-49070, using publicly available proof-of-concept exploits. This particular vulnerability was leveraged to target vulnerable Confluence servers, illustrating the broader trend of attackers focusing on exploiting software weaknesses to gain unauthorized access to systems.
These incidents serve as a stark reminder of the ongoing challenges organizations face in maintaining the security of their software environments. The exploitation of OFBiz vulnerabilities, including CVE-2024-45195, highlights the critical need for timely patching and robust security practices. Organizations that use OFBiz should not only apply the latest patches promptly but also review their security measures to ensure they are adequately protected against similar threats.
Recommendations for OFBiz Users
Given the severity of CVE-2024-45195 and its potential impact, organizations using OFBiz should take immediate action. The recommended steps include:
Update to the Latest Version: Upgrade to OFBiz version 18.12.16 or later, where the patch for CVE-2024-45195 has been implemented. This version includes the necessary authorization checks that mitigate the vulnerability.
Review Security Configurations: Ensure that security configurations are correctly set up to prevent unauthorized access. Regularly review and update security settings in line with best practices.
Monitor for Exploitation Attempts: Keep an eye on network traffic and logs for any signs of exploitation attempts. Implement intrusion detection and prevention systems that can identify and block unauthorized access attempts.
Educate and Train Staff: Make sure that IT and security teams are aware of the vulnerability and understand the steps needed to protect the organization’s systems.
Stay Informed: Continuously monitor security advisories from Apache, CISA, and other relevant sources to stay updated on any new vulnerabilities or patches related to OFBiz.
By taking these proactive measures, organizations can significantly reduce the risk of exploitation and safeguard their critical business operations from potential cyberattacks.
Follow us on 
(Twitter) for real time updates and exclusive content.