PT-2024-3458 · Apache · Apache Ofbiz

Qiyi Zhang + 1 · Published 2024-05-08 · Updated 2026-02-16 · CVE-2024-32113

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 18.12.13

Description The issue is related to an improper limitation of a pathname to a restricted directory, also known as a path traversal vulnerability. This allows a remote attacker to execute arbitrary code by injecting a specially crafted URL. The vulnerability has been exploited in real-world attacks, with one of the attackers being the Mirai botnet. The exploitation is relatively simple, involving the addition of a semicolon (;) after a public URL, followed by a private URL that the attacker wishes to access. This can bypass authentication and allow code execution on the server.

Recommendations To resolve the issue, users are recommended to upgrade to version 18.12.13, which fixes the issue. As a temporary workaround, consider restricting access to vulnerable API endpoints, such as /webtools/control/forgotPassword, to minimize the risk of exploitation. Additionally, avoid using specially crafted URLs that could be used to exploit the path traversal vulnerability.

Exploit

Fix

Incorrect Authorization

Path traversal

Weakness Enumeration

CWE-863

CWE-22

Related Identifiers

BDU:2024-03744

BDU:2024-05995

CVE-2024-32113

Affected Products

Apache Ofbiz

References · 73

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_ofbiz_forgot_password_directory_traversal.rb · Exploit
• 🔥 https://github.com/Mr-xn/CVE-2024-32113 · Exploit
• 🔥 https://github.com/RacerZ-fighting/CVE-2024-32113-POC · Exploit
• 🔥 https://github.com/YongYe-Security/CVE-2024-32113 · Exploit
• 🔥 https://exploit-db.com/exploits/52020 · Exploit
• https://lists.apache.org/thread/w6s60okgkxp2th1sr8vx0ndmgk68fqrd · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03744 · Security Note
• https://bdu.fstec.ru/vul/2024-05995 · Security Note
• https://ofbiz.apache.org/security.html · Patch
• https://issues.apache.org/jira/browse/OFBIZ-13006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32113 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32113 · Vendor Advisory
• https://github.com/apache/ofbiz-framework/commit/9b20a93c2487cca47392e6489472495ab4719447 · Note
• https://t.me/cibsecurity/79555 · Telegram Post
• https://twitter.com/CybleInsights/status/1833502973387018554 · Twitter Post