CVE-2024-38856

CVE-2024-38856 is an incorrect authorization flaw (CWE-863) in Apache OFBiz, an open-source ERP and e-commerce platform, affecting all versions through 18.12.14. On deployments where screen definitions do not explicitly verify a user's permissions because they rely on the configuration of the endpoints serving them, unauthenticated endpoints can be made to execute the screens' rendering code. As coverage of the fix describes, this can be leveraged for unauthenticated (pre-auth) remote code execution on the OFBiz server, consistent with the critical 9.8 CVSS score. Any organization running Apache OFBiz 18.12.14 or earlier, especially with the OFBiz web interface exposed to the internet, is affected. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2024-08-27 amid active exploitation reports, and EPSS estimates a 99.4% probability of exploitation within 30 days.

What to do: Upgrade all Apache OFBiz servers to version 18.12.15 or later immediately; the KEV listing requires applying vendor mitigations or discontinuing use within the required deadline, and newer OFBiz releases also address additional 2024 flaws (e.g., CVE-2024-45195), so updating to the latest available version is prudent. Inventory internet-facing OFBiz deployments and restrict unauthenticated access to OFBiz web endpoints where possible. Hunt for signs of exploitation (unexpected screen/view rendering requests to unauthenticated endpoints and follow-on activity on OFBiz hosts), since the flaw is being actively exploited.