CVE-2023-50968: Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri…

PriorityP183high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

ITWEXPLOITVulnCheck KEV

Exploited in the wild

EPSS

63.37%

99.1th percentile

Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes this issue.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apache	ofbiz	< 18.12.11	18.12.11
apache	ofbiz	—	—
apache_software_foundation	apache_ofbiz	<= 18.12.10	—

Detection & IOCsextracted from sources · hover to see the quote

url/partymgr/control/getJSONuiLabel

url/partymgr/control/getJSONuiLabelArray

cookieOFBiz.Visitor=

otherrequiredLabel={"http://<interactsh-url>/api":"<rand>"}

otherrequiredLabels={"http://<interactsh-url>/api":"<rand>"}

→Monitor for unauthenticated POST requests to /partymgr/control/getJSONuiLabel or /partymgr/control/getJSONuiLabelArray with JSON-encoded URL values in the 'requiredLabel' or 'requiredLabels' parameters — this is the SSRF/file-property-read attack vector.
→Presence of the 'OFBiz.Visitor=' cookie in HTTP responses can confirm the target is running Apache OFBiz; combine with the malicious endpoint access for high-confidence detection.
→Use Shodan/FOFA queries 'html:"OFBiz"', 'http.html:"ofbiz"', 'ofbiz.visitor=', 'app="Apache_OFBiz"', or 'body="ofbiz"' to identify exposed OFBiz instances for proactive scanning.
→The attack uses a clusterbomb payload combination across two paths (getJSONuiLabel, getJSONuiLabelArray) and two parameters (requiredLabel, requiredLabels); detection rules should cover all four combinations.
→The fix was introduced in commit 82c1737688 on Apache OFBiz 18.12.11; any instance running a version prior to 18.12.11 should be considered vulnerable. ↗

·The exploit requires no authentication (PR:N); the vulnerable endpoints /partymgr/control/getJSONuiLabel and /partymgr/control/getJSONuiLabelArray are accessible without any prior authorization. ↗
·EPSS score of 0.83897 (99.3rd percentile) indicates very high likelihood of exploitation in the wild; prioritize detection and patching accordingly.

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vulncheck7.5HIGH

vendor_apache7.5HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.