CISA Adds Critical Apache OFBiz Vulnerability to Known Exploited Vulnerabilities Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2024-32113 to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. This vulnerability affects Apache OFBiz, an open-source enterprise resource planning (ERP) system used by organizations worldwide for inventory, order management, accounting, and customer relationship management.

CVE-2024-32113 is a path traversal vulnerability in Apache OFBiz versions before 18.04.06. The flaw exists in the handling of user-supplied paths within the application's file processing mechanisms. Attackers can exploit this vulnerability by sending specially crafted HTTP requests that bypass security controls, allowing them to traverse outside intended directories and access sensitive system files or execute arbitrary code.

The vulnerability carries a CVSS v3.1 base score of 9.8, classifying it as Critical. The attack vector is network-based, requires low attack complexity, and needs no privileges or user interaction. This makes it particularly dangerous for organizations running exposed OFBiz instances.

According to CISA's KEV catalog entry, federal agencies have been directed to remediate this vulnerability by November 21, 2024. While CISA has not disclosed specific details about the exploitation campaign, the addition to the KEV catalog indicates confirmed reports of real-world attacks.

Apache OFBiz is a Java-based framework that provides a suite of enterprise applications. Organizations use it for manufacturing, e-commerce, accounting, and supply chain management. The vulnerability affects the default configuration of OFBiz installations, particularly those exposed to the internet for business operations.

Affected Versions

• Apache OFBiz versions prior to 18.04.06
• All installations running older versions are vulnerable

Mitigation Steps

Immediate action is required for all organizations running Apache OFBiz:

1. Upgrade to Apache OFBiz 18.04.06 or later. This version contains the official patch that resolves CVE-2024-32113. Download from the official Apache OFBiz website.

2. If immediate upgrade is not possible:

   • Restrict network access to OFBiz instances using firewall rules
   • Implement web application firewall (WAF) rules to block suspicious path traversal patterns
   • Disable or restrict access to vulnerable endpoints
   • Monitor logs for exploitation attempts

3. Post-patch verification:

   • Review system logs for signs of compromise
   • Check for unauthorized file access or modifications
   • Verify no suspicious processes are running
   • Consider engaging a security firm for forensic analysis if compromise is suspected

Technical Details

The vulnerability exploits OFBiz's handling of file paths in its web request processing. The application uses Java's file I/O operations without sufficient validation of user-supplied paths. Specifically, the flaw resides in how OFBiz processes certain HTTP parameters that are used to construct file paths.

An attacker can craft requests containing dot-dot-slash (../) sequences or alternative encoding methods to bypass the application's path validation. Once the attacker escapes the intended directory structure, they can:

• Read sensitive configuration files containing database credentials
• Access system files that could reveal server architecture
• Potentially write files to achieve remote code execution

This type of vulnerability is common in Java web applications that use user input to construct file system operations without proper canonicalization and validation.

Broader Context

CVE-2024-32113 is part of a pattern of critical vulnerabilities discovered in Apache OFBiz in recent years. The application's complexity and extensive feature set create a large attack surface. Organizations running OFBiz should implement a comprehensive patch management strategy and consider the risks of exposing ERP systems directly to the internet.

The addition to CISA's KEV catalog should serve as a wake-up call for organizations that may be running outdated OFBiz instances. ERP systems contain sensitive business data and are high-value targets for attackers. The confirmed exploitation indicates that threat actors are actively scanning for and attacking vulnerable systems.

Organizations should also review their exposure of other enterprise applications and ensure they have proper vulnerability management processes in place. The speed with which CISA added this vulnerability to the KEV catalog suggests significant risk to federal and private sector networks alike.

For ongoing updates and additional technical information, organizations should monitor the Apache OFBiz security page and CISA's Known Exploited Vulnerabilities Catalog.