CVE-2024-38856
published 2024-08-05CVE-2024-38856: Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15…
PriorityP196critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2024-09-17
Exploited in the wild
EPSS
99.43%
99.9th percentile
Incorrect Authorization vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: through 18.12.14.
Users are recommended to upgrade to version 18.12.15, which fixes the issue.
Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | ofbiz | < 18.12.15 | 18.12.15 |
| apache | ofbiz | — | — |
| apache_software_foundation | apache_ofbiz | <= 18.12.14 | — |
Detection & IOCsextracted from sources · hover to see the quote
commandgroovyProgram=\u0074\u0068\u0072\u006f\u0077\u0020\u006e\u0065\u0077\u0020\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0028\u0027\u0069\u0064\u0027\u002e\u0065\u0078\u0065\u0063\u0075\u0074\u0065\u0028\u0029\u002e\u0074\u0065\u0078\u0074\u0029\u003b↗
commandgroovyProgram=\u0074\u0068\u0072\u006f\u0077\u0020\u006e\u0065\u0077\u0020\u0045\u0078\u0063\u0065\u0070\u0074\u0069\u006f\u006e\u0028\u0027\u0069\u0070\u0063\u006f\u006e\u0066\u0069\u0067\u0027\u002e\u0065\u0078\u0065\u0063\u0075\u0074\u0065\u0028\u0029\u002e\u0074\u0065\u0078\u0074\u0029\u003b↗
- →Detect unauthenticated POST requests to the path-traversal endpoint pattern /webtools/control/<view>/ProgramExport, which bypasses authorization by chaining a permitted view (e.g., 'main') with the restricted ProgramExport endpoint. ↗
- →Alert on POST requests to /webtools/control/forgotPassword that contain a ProgramExport path component, indicating exploitation of the controller-view map fragmentation issue. ↗
- →Inspect POST body for the 'groovyProgram' parameter containing Unicode-escaped payloads (e.g., \u0074\u0068\u0072\u006f\u0077) targeting the ProgramExport endpoint, which is the primary RCE delivery mechanism. ↗
- →Flag responses containing 'java.lang.Exception' in the body alongside HTTP 200 status from OFBiz endpoints, which is a strong indicator of successful Groovy script execution via ProgramExport. ↗
- →Use Shodan/FOFA queries to identify exposed OFBiz instances: FOFA app="Apache_OFBiz" and Shodan title:"OFBiz" for attack surface enumeration. ↗
- →CVE-2024-38856 is a patch bypass for CVE-2024-32113, CVE-2024-36104, and CVE-2024-45195 — all sharing the same controller-view map fragmentation root cause. Detections for any of these should be cross-correlated. ↗
- →The execution of user-provided Groovy scripts has inadequate blocklisting — monitor for Groovy script execution patterns (e.g., .execute(), ipconfig, id commands) in OFBiz request bodies. ↗
- ·Exploitation requires specific preconditions: screen definitions must not explicitly check user permissions, relying instead on endpoint configuration for access control. ↗
- ·CVE-2024-38856 affects Apache OFBiz through version 18.12.14 only; version 18.12.15 contains the fix. Detections should be scoped to vulnerable version ranges. ↗
- ·The Nuclei template uses a max of 2 requests and matches on HTTP 200 status combined with body regex — single-condition matches may produce false positives; all three matcher conditions (regex OR, word, status) must be satisfied. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_apache9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gp2r-34c8-48xq: Incorrect Authorization vulnerability in Apache OFBiz
ghsa_unreviewed·2024-08-05
CVE-2024-38856 [HIGH] CWE-863 GHSA-gp2r-34c8-48xq: Incorrect Authorization vulnerability in Apache OFBiz
Incorrect Authorization vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: through 18.12.14.
Users are recommended to upgrade to version 18.12.15, which fixes the issue.
Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
VulnCheck
Apache OFBiz Incorrect Authorization Vulnerability
vulncheck·2024·CVSS 9.8
CVE-2024-38856 [CRITICAL] CWE-863 Apache OFBiz Incorrect Authorization Vulnerability
Apache OFBiz Incorrect Authorization Vulnerability
Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.
Affected: Apache OFBiz
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://www.fortiguard.com/outbreak-alert/apache-ofbiz-rce; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://info.greynoise.io/hubfs/resources/GreyNoise-2025-Mass-Internet-Exploitation-Report.pdf; https://cyble.com/blog/cyble-sensors-detect-exploit-attempts-on-ivanti-avtech-ip-cameras/; https://app.crowdsec.net/cti/cve-explorer/CV
CISA
Apache OFBiz Incorrect Authorization Vulnerability
cisa·2024-08-27·CVSS 9.8
CVE-2024-38856 [CRITICAL] CWE-863 Apache OFBiz Incorrect Authorization Vulnerability
Vulnerability: Apache OFBiz Incorrect Authorization Vulnerability
Affected: Apache OFBiz
Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy payload in the context of the OFBiz user process by an unauthenticated attacker.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w; https://nvd.nist.gov/vuln/detail/CVE-2024-38856
Remediation Due Date: 2024-09-17
Apache
Apache ofbiz: CVE-2024-38856
vendor_apache·CVSS 9.8
CVE-2024-38856 [CRITICAL] Apache ofbiz: CVE-2024-38856
Apache ofbiz: CVE-2024-38856
; affected releases before 18.12.15; fixed in 18.12.15 with commit 31d8d7
Suricata
ET WEB_SPECIFIC_APPS Apache OFBiz Pre-Auth Remote Code Execution Attempt (CVE-2024-38856)
suricata·2024-08-06·CVSS 9.8
CVE-2024-38856 [CRITICAL] ET WEB_SPECIFIC_APPS Apache OFBiz Pre-Auth Remote Code Execution Attempt (CVE-2024-38856)
ET WEB_SPECIFIC_APPS Apache OFBiz Pre-Auth Remote Code Execution Attempt (CVE-2024-38856)
Rule: alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Apache OFBiz Pre-Auth Remote Code Execution Attempt (CVE-2024-38856)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/webtools/control/"; fast_pattern; startswith; pcre:"/^(?:TestService|view|showDateTime|main|forgotPassword)/R"; content:"ProgramExport"; endswith; http.request_body; content:"groovyProgram"; startswith; reference:url,blog.sonicwall.com/en-us/2024/08/sonicwall-discovers-second-critical-apache-ofbiz-zero-day-vulnerability/; reference:cve,2024-38856; classtype:attempted-admin; sid:2054947; rev:1; metadata:affected_product Apache_OFBiz, attack_target Server, tls_state TLSDecrypt, created_at
Nuclei
Apache OFBiz - Improper Authorization & Remote Code Execution
nuclei·CVSS 9.8
CVE-2024-38856 [CRITICAL] Apache OFBiz - Improper Authorization & Remote Code Execution
Apache OFBiz - Improper Authorization & Remote Code Execution
Improper Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
Template:
id: CVE-2024-38856
info:
name: Apache OFBiz - Improper Authorization & Remote Code Execution
author: Co5mos
severity: critical
description: |
Improper Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to versio
Metasploit
Apache OFBiz forgotPassword/ProgramExport RCE
metasploit·CVSS 9.8
CVE-2024-32113 [CRITICAL] Apache OFBiz forgotPassword/ProgramExport RCE
Apache OFBiz forgotPassword/ProgramExport RCE
Apache OFBiz versions prior to 18.12.13 are vulnerable to a path traversal vulnerability (CVE-2024-32113). The vulnerable endpoint /webtools/control/forgotPassword allows an attacker to access the ProgramExport endpoint which in turn allows for remote code execution in the context of the user running the application. This was patched in 18.12.14. It was then discovered that the use of the path traversal vulnerability is not required in order to access the vulnerable endpoint ProgramExport. CVE-2024-38856 was given for this Incorrect Authorization vulnerability and was patched in 18.12.15. This module was originally written the exploit CVE-2024-32113, but upon the discovery of CVE-2024-38856 the module updated to not exploit the path traversal
Zscaler
CVE-2025-29927: Next.js Middleware Flaw | ThreatLabz
blogs_zscaler·2025-03-27·CVSS 9.1
[CRITICAL] CVE-2025-29927: Next.js Middleware Flaw | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Zscaler
CVE-2025-24813: Apache Tomcat Vulnerability | ThreatLabz
blogs_zscaler·2025-03-21·CVSS 9.8
[CRITICAL] CVE-2025-24813: Apache Tomcat Vulnerability | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Bleepingcomputer
Apache fixes critical OFBiz remote code execution vulnerability
blogs_bleepingcomputer·2024-09-05·CVSS 9.8
[CRITICAL] Apache fixes critical OFBiz remote code execution vulnerability
## Apache fixes critical OFBiz remote code execution vulnerability
## Sergiu Gatlan
Apache has fixed a critical security vulnerability in its open-source OFBiz (Open For Business) software, which could allow attackers to execute arbitrary code on vulnerable Linux and Windows servers.
OFBiz is a suite of customer relationship management (CRM) and enterprise resource planning (ERP) business applications that can also be used as a Java-based web framework for developing web applications.
Tracked as CVE-2024-45195 and discovered by Rapid7 security researchers, this remote code execution flaw is caused by a forced browsing weakness that exposes restricted paths to unauthenticated direct request attacks.
"An attacker with no valid credentials can exploit missing view authorization checks in
Zscaler
CVE-2024-38856 | ThreatLabz
blogs_zscaler·2024-08-12·CVSS 9.1
[CRITICAL] CVE-2024-38856 | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Bleepingcomputer
CISA warns about actively exploited Apache OFBiz RCE flaw
blogs_bleepingcomputer·2024-08-08·CVSS 9.8
[CRITICAL] CISA warns about actively exploited Apache OFBiz RCE flaw
## CISA warns about actively exploited Apache OFBiz RCE flaw
## Bill Toulas
The U.S. Cybersecurity & Infrastructure Security Agency is warning of two vulnerabilities exploited in attacks, including a path traversal impacting Apache OFBiz.
Apache OFBiz (Open For Business) is a popular open-source enterprise resource planning (ERP) system that provides a suite of business applications to manage various aspects of an organization. Due to its versatility and cost-effectiveness, it's used in a wide range of industries and business sizes.
The flaw added to CISA's Known Exploited Vulnerability Catalog (KEV) is CVE-2024-32113 , a path traversal vulnerability impacting OFBiz versions before 18.12.13 . If exploited, it could allow attackers to remotely execute arbitrary commands on vulnerable se
Zscaler
CVE-2023-51467 | ThreatLabz
blogs_zscaler·2024-01-08·CVSS 9.8
[CRITICAL] CVE-2023-51467 | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Zscaler
CVE-2023-50164 Coverage Advisory | ThreatLabz
blogs_zscaler·2023-12-18·CVSS 9.8
[CRITICAL] CVE-2023-50164 Coverage Advisory | ThreatLabz
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
arXiv
Towards Improving IDS Using CTF Events
arxiv_fulltext·2025-01-20
Towards Improving IDS Using CTF Events
Towards Improving Intrusion Detection Systems Using Capture the Flag Events
Towards Improving IDS Using CTF Events
Manuel Kern1 Florian Skopik1 Max Landauer1 Edgar Weippl2
M. Kern et al.
Austrian Institute of Technology, Giefinggasse 4 1210 Vienna
University of Vienna, Universitaetsring 1, 1010 Vienna
## Abstract
In cybersecurity, Intrusion Detection Systems (IDS) serve as a vital defensive layer against adversarial threats. Accurate benchmarking is critical to evaluate and improve IDS effectiveness, yet traditional methodologies face limitations due to their reliance on previously known attack signatures and lack of creativity of automated tests. This paper introduces a novel approach to evaluating IDS through Capture the Flag (CTF) events, specifically designed to uncover weaknesse
https://issues.apache.org/jira/browse/OFBIZ-13128https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7whttps://ofbiz.apache.org/download.htmlhttps://ofbiz.apache.org/security.htmlhttp://www.openwall.com/lists/oss-security/2024/08/04/1https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38856
2024-08-05
Published
2024-08-27
Added to CISA KEV
Exploited in the wild