Apache Software Foundation OFBiz

Unsafe deserialization in Apache OFBiz

Apache Open For Business Project (aka OFBiz) 10.04.01 through 10.04.05, 11.04.01 through 11.04.02, and 12.04.01 allows remote attackers to execute arbitrary Unified Expression Language (UEL) functions via JUEL metacharacters in unspecified parameters, related to nested expressions.

Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors.

Apache OFBiz: Confused controller-view authorization logic (forced browsing)

Apache OFBiz: Path traversal leading to RCE

Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI

Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability

Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present

Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE

RCE vulnerability in latest Apache OFBiz due to Java serialisation using RMI

The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/control/httpService" URL, and uses Java deserialization to perform code execution. In the HttpEngine, the value of the request parameter "serviceContext" is passed to the "deserialize" method of "XmlSerializer". Apache Ofbiz is affected via two different dependencies: "commons-beanutils" and an out-dated version of "commons-fileupload" Mitigation: Upgrade to 16.11.06 or manually apply the commits from OFBIZ-10770 and OFBIZ-10837 on branch 16

Apache OFBiz: RCE Vulnerability in scrum plugin

Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

Arbitrary file upload vulnerability in OFBiz

Unauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBiz

The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. This service takes the `serviceContent` parameter in the request and deserializes it using XStream. This `XStream` instance is slightly guarded by disabling the creation of `ProcessBuilder`. However, this can be easily bypassed (and in multiple ways). Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16 r1850017+1850019

Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors.

Java Deserialization via RMI Connection from the Solr plugin of Apache OFBiz

An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been disabled on such a field. This was the case for the Customer Request "story" input in the Order Manager application. Encoding should not be disabled without good reason and never within a field that accepts user input. Mitigation: Upgrade to 16.11.06 or manually apply the following commit on branch 16.11: r1858533

The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed. This allows for code injection by passing that code through the URL. For example by appending this code "__format=%27;alert(%27xss%27)" to the URL an alert window would execute.

Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE

Apache OFBiz: Authentication Bypass via Password-Change Logic Flaw Leading to RCE

Apache OFBiz: Path traversal leading to a RCE

Apache OFBiz: Path traversal allowing authentication bypass.

Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction

Apache OFBiz: Unauthenticated RCE via Default JWT Signing Key and Widget Template Injection

Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)

Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.

By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz 16.11.01

Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution

Apache OFBiz: Improper Validation in traverseContent Service Enables Authenticated Groovy Code Execution

Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass

Server-Side Template Injection affecting the ecommerce plugin of Apache OFBiz

Apache OFBiz: Arbitrary file properties reading and SSRF attack

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName, serviceMode, and serviceContext. The exploitation occurs by having DOCTYPEs pointing to external references that trigger a payload that returns secret information from the host.

The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.

Apache OFBiz: Arbitrary file reading vulnerability

Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host

Generation of Error Message Containing Sensitive Information in Apache OFBiz