Apache OFBiz Code Injection Vulnerability

Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to a code injection flaw that allows a remote unauthenticated attacker to execute arbitrary code on the server.

The attack works by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request. This causes OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page.

• The exploit does not require a malformed or incomplete multipart body; a well-formed multipart request that is kept in flight and then allowed to complete normally is sufficient.
• The screen loader reads the widget XML from a live process file descriptor while the upload is streaming, not from any file the attacker persists to disk.
• The same issue is also reachable through the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in an HTTP 200 response.

Users are recommended to upgrade to version 24.09.08, which fixes this issue.