Incorrect Authorization Vulnerability Affects Apache OFBiz Through 18.12.14

CVE-2024-38856

9.8CRITICAL

Key Information

Vendor: Apache
Status: Apache Ofbiz
Vendor: CVE Published:; 5 August 2024

Badges

🥇 Trended No. 1📈 Trended📈 Score: 7,150💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 94%🦅 CISA Reported📰 News Worthy

What is CVE-2024-38856?

CVE-2024-38856 is an incorrect authorization vulnerability affecting Apache OFBiz, an open-source enterprise resource planning (ERP) system widely utilized for automating various business processes. This vulnerability permits unauthorized access to certain endpoints, enabling unauthorized users to execute screen rendering code under specific conditions. The risk posed by this vulnerability is significant, as it can lead to unintended data exposure, unauthorized operations, and potential manipulation of the system, ultimately jeopardizing organizational integrity and security.

Technical Details

The issue stems from the reliance on endpoint configurations without sufficient checks on user permissions. In particular, it affects Apache OFBiz versions up to and including 18.12.14. If the screen definitions do not explicitly validate user permissions, it may allow unauthenticated users to interact with the system in ways that should be restricted. The vulnerability requires certain preconditions to be met, which could vary based on the existing deployment and configuration of the affected software.

Impact of the Vulnerability

Unauthorized Access: Attackers can exploit this vulnerability to gain unprivileged access to the ERP system, leading to potential unauthorized actions that can disrupt business operations.
Data Exposure: The lack of proper authorization checks can result in sensitive information being accessible to unauthorized users, posing a risk of data breaches and compliance issues.
System Manipulation: Exploitation of this vulnerability may enable malicious users to execute unauthorized operations, potentially leading to system misconfiguration and manipulation of business processes, which can adversely affect organizational productivity and security.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2024-38856 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

Apache OFBiz <= 18.12.14

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-38856_Scanner
Created by securelayer7

CVE-2024-38856-ApacheOfBiz
Created by Praison001

CVE-2024-38856
Created by emanueldosreis

News Articles

The Cyber Express

CVE-2024-38856

CISA Flags Apache OFBiz Vulnerability (CVE-2024-38856)

CISA flags CVE-2024-38856 in Apache OFBiz as critical. Upgrade to version 18.12.15 to avoid exploitation risks. CVE-2024-36104 also affects earlier versions.

4 months ago