CVE-2024-36104

published 2024-06-04

CVE-2024-36104: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14…

Priority P1 90 critical 9.1 CVSS 3.1

AV N AC L PR N UI N S U C H I H A N

ITW EXPLOIT VulnCheck KEV

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14.

Users are recommended to upgrade to version 18.12.14, which fixes the issue.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apache	ofbiz	< 18.12.14	18.12.14
apache	ofbiz	—	—
apache_software_foundation	apache_ofbiz	< 18.12.14	18.12.14

Detection & IOCs extracted from sources · hover to see the quote

url POST /webtools/control/forgotPassword/;%2e%2e/ProgramExport↗

url POST /webtools/control/forgotPassword/%2e/%2e/ProgramExport↗

command groovyProgram=throw new Exception('whoami'.execute().text);↗

path /webtools/control/forgotPassword/%2e/%2e/ProgramExport↗

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache OFBiz Directory Traversal Remote Code Execution Attempt (CVE-2024-36104)"; flow:established,to_server; pcre:"/(?:\%2e|\x2e|\x3b|\%3b){1,2}(?:\%2f|\x2f)/I"; http.method; content:"POST"; http.uri; content:"/webtools/control"; startswith; content:"ProgramExport"; fast_pattern; endswith; http.request_body; content:"groovyProgram|3d|"; startswith; reference:url,issues.apache.org/jira/browse/OFBIZ-13092; reference:cve,2024-36104; classtype:attempted-admin; sid:2053485; rev:2; metadata:affected_product Apache_OFBiz, created_at 2024_06_12, cve CVE_2024_36104, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_11_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

• → Look for POST requests to /webtools/control/ paths containing path traversal sequences (%2e, %2f, %3b, semicolons) followed by 'ProgramExport' in the URI, combined with 'groovyProgram=' in the request body.
• → Exploit responses may contain 'java.lang.Exception' in the HTTP response body, indicating successful Groovy code execution via the ProgramExport endpoint. ↗
• → The attack uses the forgotPassword (or other public view) endpoint as a bypass prefix with encoded path traversal (e.g., /;%2e%2e/ or /%2e/%2e/) to reach the restricted ProgramExport endpoint without authentication. ↗
• → Shodan/FOFA fingerprinting for exposed OFBiz instances: search for http.title:"ofbiz", http.html:"apache ofbiz", or the cookie value 'ofbiz.visitor=' to identify attack surface. ↗
• → Zscaler threat signatures for this CVE are deployed as 'App.Exploit.CVE-2024-36104' under Advanced Threat Protection. ↗

• · CVE-2024-36104 is closely related to CVE-2024-38856 and CVE-2024-32113; all share the same root cause (controller-view map fragmentation). Patching only one may leave the system vulnerable to the others. Full remediation requires upgrading to OFBiz 18.12.16. ↗
• · The Nuclei template uses Unicode-escaped Groovy payloads (e.g., \u0074\u0068\u0072...) to evade simple string-match detections; detection rules must account for encoded variants. ↗
• · Multiple public view endpoints (forgotPassword, showDateTime, TestService, view, main) can be used as the bypass prefix — detection must not be limited to forgotPassword alone. ↗

CVSS provenance

nvd v3.1 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vulncheck 9.1 CRITICAL

vendor_apache 9.1 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22