Apache OFBiz: Unauthenticated RCE (CVE-2024-38856)

What to do

1. Upgrade to the latest OFBiz release listed on ofbiz.apache.org (18.12.16 at minimum)
2. If you cannot upgrade today, take the OFBiz web interface off the internet or put it behind a VPN or authenticating proxy
3. Block requests to ProgramExport and similar admin views via unauthenticated controllers at your reverse proxy as a stopgap
4. Check vendor products that embed OFBiz for their own patched builds
5. Hunt for compromise before declaring the host clean

How to check if you are affected or compromised

• Search access logs for requests to ProgramExport, EntitySQLProcessor or XmlDsDump under non-webtools controllers such as /forgotPassword/
• Look for POST bodies containing Groovy code
• Check for unexpected child processes (sh, bash, curl, wget, powershell) spawned by the OFBiz Java process
• Review the host for new web shells, cron jobs or outbound connections to unknown IPs

What happened#

On August 5, 2024, the Apache OFBiz project published CVE-2024-38856, an incorrect authorization flaw in the open source ERP framework. The CVE record says unauthenticated endpoints "could allow execution of screen rendering code of screens if some preconditions are met", affecting OFBiz through 18.12.14 and fixed in 18.12.15. In practice it meant unauthenticated remote code execution: NVD scores it 9.8, while CISA's ADP entry in the CVE record gives 8.1.

The bug was found by SonicWall's research team and is the third chapter of one story. Rapid7's analysis explains the shared root cause: OFBiz's controller and view map can fall out of sync, so a request handled by an unauthenticated controller can render an admin-only view. One such view, ProgramExport, runs Groovy scripts. CVE-2024-32113 (fixed in 18.12.13) reached it with path traversal; the fix normalized URLs. CVE-2024-36104 (fixed in 18.12.14) used semicolons and encoded dots; the fix stripped those sequences. CVE-2024-38856 needed neither: Rapid7 notes a plain request to /forgotPassword/ProgramExport was enough. The 18.12.15 fix added permission checks to ProgramExport and EntitySQLProcessor only, and Rapid7 then showed other views remained reachable, leading to CVE-2024-45195, fixed in 18.12.16.

Who is affected#

Any Apache OFBiz deployment through 18.12.14 is vulnerable to CVE-2024-38856, and 18.12.15 is still exposed to the same root cause via CVE-2024-45195. The OFBiz security page lists each fix version and commit. OFBiz is also embedded in commercial and in-house products, so check for it inside vendor software, not just standalone installs.

Do you really need to act?#

Yes, if you run OFBiz. There is no meaningful precondition for an attacker beyond reaching the web interface. CISA added CVE-2024-38856 to the Known Exploited Vulnerabilities catalog on August 27, 2024 based on evidence of active exploitation, and as of October 21, 2026 it remains listed. CVE-2024-32113 and CVE-2024-45195 are in KEV too. Four CVEs for one root cause between May and September 2024 is the strongest argument for treating OFBiz as a high-risk internet-facing app: put it behind access control even after patching.

If you do not run OFBiz or a product built on it, there is nothing to do.

What to do now#

1. Upgrade to the newest release on the OFBiz download page. 18.12.16 is the minimum that closes this root cause; later releases fix further issues.
2. If you cannot upgrade immediately, remove internet exposure: VPN-only access or an authenticating reverse proxy in front of the application.
3. As a stopgap, block access to admin views such as ProgramExport, EntitySQLProcessor and XmlDsDump through any controller other than an authenticated webtools path.
4. Ask vendors of OFBiz-based products for their patched builds and timelines.
5. Hunt for compromise before returning a previously exposed host to service.

How to tell if you were hit#

Search web access logs for requests to ProgramExport, EntitySQLProcessor or XmlDsDump under unexpected controllers such as /forgotPassword/, and for request bodies carrying Groovy code. On the host, look for shells, curl, wget or PowerShell spawned by the OFBiz Java process, new web shells in the deployment directory, unfamiliar scheduled tasks, and outbound connections to unknown addresses. Any hit on an exposed pre-18.12.16 server warrants full incident response, including credential rotation for the database the ERP uses.

Timeline#

• May 8, 2024 — CVE-2024-32113 published; fixed in 18.12.13.
• Jun 4, 2024 — CVE-2024-36104 published; fixed in 18.12.14.
• Aug 5, 2024 — CVE-2024-38856 published; fixed in 18.12.15.
• Aug 27, 2024 — CISA adds CVE-2024-38856 to KEV.
• Sep 5, 2024 — Rapid7 discloses bypass CVE-2024-45195; fixed in 18.12.16.

Vulnerability records

• CVE-2024-38856 · KEV 2024-08-27 · Incorrect Authorization vulnerability in Apache OFBiz.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. CVE.org — CVE-2024-38856 record (Apache Software Foundation, CNA) cve.org
2. NVD — CVE-2024-38856 nvd.nist.gov
3. Apache OFBiz — Security ofbiz.apache.org
4. CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Aug 27, 2024) cisa.gov
5. Rapid7 — CVE-2024-45195: Apache OFBiz Unauthenticated Remote Code Execution (Fixed) rapid7.com