Loading vulnerability…
Apache OFBiz Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection
Apache OFBiz versions before 24.09.06 use a hard-coded default cryptographic key for HMAC-SHA-512 JWT validation. On SSO-enabled installations retaining this key, an unauthenticated attacker can forge trusted tokens and impersonate an administrator. The attacker can then enable the JavaScriptEnabled preference and submit a forged widget callback token containing a Groovy expression in its areaTarget claim. The widget engine passes this value through template expansion into expression evaluation. A case-sensitive denylist can be bypassed using alternative Groovy syntax and class references, allowing remote code execution. The demonstrated chain affects version 24.09.05 and requires two unauthenticated GET requests.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits administrator impersonation and arbitrary server-side code execution with the privileges of the OFBiz process. An attacker can access or modify application data and configuration and execute operating-system commands within the service account's permissions.
If you can’t patch tonight, do this now.
Disable SSO if it is not required, and replace the shared default signing key with a strong, deployment-specific secret. Restrict network access to OFBiz to trusted clients while remediation is pending. Where feasible, remove or tightly constrain server-side template evaluation and validate callback claims according to their expected purpose and permitted values rather than relying solely on JWT signature validity.
Patch, then assume compromise.
Upgrade Apache OFBiz to version 24.09.06 or a later supported release containing the fix. Replace the factory-default signing key with a deployment-specific secret and rotate any retained default keys during upgrades; do not assume upgrading replaces existing configuration secrets. A separate follow-on advisory identifies retained-default-key exposure in upgraded versions 24.09.06 and 24.09.07 and recommends version 24.09.08 plus explicit secret-key rotation for those deployments.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.