Loading vulnerability…
Server-Side Request Forgery in Apache OFBiz SurveyWrapper
Apache OFBiz 24.09 releases before 24.09.08 contain a server-side request forgery vulnerability in SurveyWrapper on all platforms. An authenticated back-office user with catalog permission can set an arbitrary URL as a product-store survey's template location. SurveyWrapper.getTemplate invokes URL.openStream() on the resolved location without validating its scheme or host, then compiles the retrieved content as a FreeMarker template. When a shopper loads the affected survey, the fetched content is rendered into the HTTP response, enabling non-blind disclosure of internal network resources, cloud metadata, and accessible local files.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated attacker with catalog permission can induce server-side requests to resources reachable by the OFBiz server, including internal services and cloud-metadata endpoints, and read local files accessible to the OFBiz process through the file URI scheme. Retrieved content is rendered in the affected survey's HTTP response, potentially exposing sensitive information to users who load that survey. Arbitrary code execution is not established for this vulnerability.
If you can’t patch tonight, do this now.
Until upgrading, restrict catalog permissions and the ability to modify product-store survey template locations to trusted administrators. Prevent affected surveys from rendering attacker-modified template locations. Restrict outbound access from the OFBiz server to internal services and cloud metadata endpoints where operationally feasible; network restrictions alone do not prevent local file access.
Patch, then assume compromise.
Upgrade Apache OFBiz to version 24.09.08, which fixes this vulnerability.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.