Loading vulnerability…
Authenticated RCE through incorrect authorization in Apache OFBiz updateLayout
An incorrect authorization vulnerability in the updateLayout simple-method in Apache OFBiz 24.09 before 24.09.08 affects all platforms. The method checks only the fixed CONTENT_CREATE operation instead of verifying update permission on the actual Content record and an independently selected DataResource. A remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW permissions can relink an existing RESPONSE-purpose Content record and convert the selected DataResource into an OFBIZ_FILE/FTL resource referencing the OFBiz access log. By poisoning that log through a crafted User-Agent header and triggering template evaluation through the authenticated showContent route, the attacker can execute arbitrary commands as the OFBiz process user.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
View-only access can be escalated to arbitrary command execution with the operating-system privileges of the OFBiz process. Exploitation also permits unauthorized modification of Content and DataResource records. Executed commands can compromise application data confidentiality, integrity, and availability within the process user's access rights.
If you can’t patch tonight, do this now.
No interim workaround has been specified.
Patch, then assume compromise.
Upgrade Apache OFBiz to version 24.09.08, which fixes the authorization vulnerability.
1 exploit validated by Mallory's analysis.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.