Apache OFBiz RCE Attacks Exploit Access-Control Flaws and Successive Patch Bypasses

Attackers have exploited Apache OFBiz path-traversal and authorization weaknesses to attempt unauthenticated remote code execution, while successive vulnerability discoveries exposed incomplete fixes and bypasses of earlier patches. SANS reported a sharp increase in attempts against CVE-2024-32113, which affects versions before 18.12.13, observing three source IP addresses. Crafted POST requests combined the public forgotPassword endpoint with the restricted ProgramExport endpoint to execute commands that downloaded malicious scripts. One attacker’s infrastructure also distributed a file commonly associated with Mirai variants, but SANS did not confirm Mirai attribution or recover that attacker’s script. SonicWall subsequently reported a second critical OFBiz zero-day, reinforcing concerns about recurring access-control weaknesses.

FortiGuard reported ongoing attack attempts involving CVE-2024-36104, CVE-2024-38856, and CVE-2024-45195, covering path traversal, incorrect authorization, and forced browsing. CISA added CVE-2024-38856 and CVE-2024-45195 to its Known Exploited Vulnerabilities catalog on August 27, 2024, and February 4, 2025, respectively. Apache’s remediation for CVE-2024-45195 added view-map permission checks and changed request-map authentication and HTTPS defaults to true, alongside controller configuration updates. Organizations should inventory exposed OFBiz deployments, upgrade to 18.12.16 or later to address the reported vulnerabilities, and review request logs for suspicious access to restricted endpoints. The earlier 18.12.13 update addressed CVE-2024-32113 but did not resolve the subsequently disclosed flaws.