Loading vulnerability…
Arbitrary Service Invocation in Apache OFBiz ContentWorker
Apache OFBiz 24.09 releases before 24.09.08 on all platforms contain an authorization vulnerability in ContentWorker.renderContentAsText. The renderer selects an OFBiz service using the persisted, client-writable serviceName field of a Content row and constructs service parameters directly from the live HTTP request map. It performs no service allow-list validation, ownership check, or caller authentication requirement. Once an account with CONTENTMGR_CREATE or CONTENTMGR_UPDATE permission sets the field to an attacker-selected service, an unauthenticated remote caller can invoke that service through the public showHelpPublic view. Exploitation can result in arbitrary file writes, arbitrary file deletion, and server-side request forgery.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Attackers can bypass authorization boundaries to invoke OFBiz services with attacker-controlled parameters. Depending on the selected service and the server's effective permissions, this enables arbitrary file creation or modification, arbitrary file deletion, and server-side request forgery, compromising filesystem integrity and potentially disrupting application availability or accessing network resources reachable by the server.
If you can’t patch tonight, do this now.
No interim workaround is specified. Upgrade to the fixed release.
Patch, then assume compromise.
Upgrade Apache OFBiz to version 24.09.08, which fixes this vulnerability.
1 exploit validated by Mallory's analysis.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.