CVE-2023-49070

What it actually does

This is a pre-authentication remote code execution flaw in Apache OFBiz before 18.12.10. The vulnerable XML-RPC functionality remains exposed even though it is no longer maintained, allowing a network-accessible attacker to reach an unauthenticated endpoint and cause server-side code or commands to execute in the context of the OFBiz application process. Because exploitation requires no credentials, no user interaction, and has network attack complexity rated low, a successful compromise can lead to full confidentiality, integrity, and availability impact for the affected OFBiz instance and potentially the underlying host.

Why it matters to the business

An exposed vulnerable OFBiz server can be taken over remotely, creating risk of data theft, fraudulent transaction manipulation, service outage, malware deployment, and lateral movement into connected business systems. The EPSS score is very high and exploit maturity is listed as weaponized, so internet-facing systems should be treated as high-priority even though this CVE is not currently listed in CISA KEV. The provided affected-product metadata appears inconsistent with the OFBiz description, so organizations should validate software inventory carefully rather than relying only on package-name matching.

How an attack unfolds

An attacker first identifies an Apache OFBiz deployment and probes for the XML-RPC endpoint, commonly under the webtools control path. If the instance is running a vulnerable version before 18.12.10 and the endpoint is reachable, the attacker sends a crafted XML-RPC POST request without authenticating. The OFBiz server processes the request through the legacy XML-RPC handling path and executes attacker-controlled server-side logic or commands under the privileges of the Java application process. After initial code execution, the attacker may run reconnaissance commands, drop web shells or remote access tooling, create persistence, access application data and credentials, or pivot to databases and internal services reachable from the OFBiz host.

How to fix it

Upgrade Apache OFBiz to version 18.12.10 or later immediately. If immediate upgrade is not possible, restrict external access to OFBiz, block unauthenticated access to XML-RPC and webtools endpoints, remove or disable legacy XML-RPC functionality where feasible, and place the application behind strong authentication and network allowlisting. Review any downstream or packaged distributions for the vendor-provided fixed build; the supplied package data also lists dcmtk Debian 13 fixed in 3.6.7-14 and dcmtk Git fixed in c78e434c0c5f9d932874f0b17a8b4ce305ca01f5, but this appears inconsistent with the OFBiz vulnerability description and should be verified against authoritative vendor advisories before using it as the sole remediation target.

How to confirm the fix worked

Confirm the running Apache OFBiz version is 18.12.10 or later and that no vulnerable 18.12.09 or earlier deployments remain. Verify from an unauthenticated network perspective that XML-RPC endpoints such as /webtools/control/xmlrpc are not reachable or no longer process requests. Review reverse proxy, WAF, and application routing rules to ensure webtools and XML-RPC paths are not exposed to untrusted networks. Validate package inventories and container images for embedded OFBiz components, and re-scan externally visible assets after patching or compensating controls are applied.

Typical attack path

1. Scan for internet-facing Apache OFBiz services and fingerprint likely vulnerable versions or exposed webtools paths.
2. Send unauthenticated HTTP requests to identify whether the XML-RPC endpoint is reachable, especially /webtools/control/xmlrpc.
3. Submit a crafted XML-RPC request that triggers server-side code or command execution.
4. Execute operating-system reconnaissance commands under the OFBiz Java process account.
5. Deploy a web shell, downloader, reverse shell, or other remote access mechanism.
6. Harvest application configuration, secrets, database credentials, and business data accessible to OFBiz.
7. Use the compromised server for persistence, lateral movement, data exfiltration, or disruption.

How to detect it

Look for signs of unauthenticated requests to OFBiz XML-RPC endpoints followed by unusual server-side behavior. Primary log sources include web server access logs, reverse proxy and load balancer logs, WAF alerts, Apache OFBiz runtime logs, EDR process telemetry, command-line auditing, file creation events, and outbound network connection logs from the OFBiz host. In HTTP logs, hunt for POST requests to /webtools/control/xmlrpc, XML-RPC methodCall payloads, suspicious user agents, repeated 200/500 responses during probing, and requests from scanners or unfamiliar external IPs. In EDR, investigate Java processes spawning shells or utilities such as sh, bash, cmd.exe, powershell.exe, curl, wget, python, perl, nc, ncat, certutil, or bitsadmin. On disk, look for newly created web-accessible files, scripts, dropped binaries, modified OFBiz configuration, unexpected files under OFBiz runtime or webapp directories, and persistence mechanisms created shortly after suspicious XML-RPC requests. Network telemetry should be reviewed for unusual outbound connections from the OFBiz server to external IPs, especially immediately after XML-RPC POST activity.

• POST /webtools/control/xmlrpc
• /webtools/control/xmlrpc
• <methodCall>
• <methodName>
• Content-Type: text/xml
• runtime/logs/ofbiz.log
• runtime/logs/error.log
• runtime/logs/access.log
• java -> /bin/sh
• java -> /bin/bash
• java -> sh
• java -> bash
• java.exe -> cmd.exe
• java.exe -> powershell.exe
• java -> curl
• java -> wget
• java -> nc
• java -> ncat
• java -> python
• java -> perl
• /webtools/control/
• XML-RPC

What your security team should do

• Prioritize all internet-facing Apache OFBiz instances for emergency upgrade to 18.12.10 or later because exploitation is weaponized and EPSS is very high.
• Perform an exposure sweep for /webtools/control/xmlrpc and related OFBiz webtools paths across external and internal attack surfaces.
• If patching cannot be completed immediately, block XML-RPC/webtools access at the reverse proxy, WAF, load balancer, or network layer.
• Hunt for prior exploitation using web access logs, OFBiz application logs, EDR process lineage, and file-integrity telemetry from the publication date onward, with emphasis on recent activity.
• Investigate any Java application process spawning shell, scripting, downloader, or network utility processes as potentially malicious.
• Rotate credentials and secrets stored on or accessible from OFBiz hosts if exploitation is suspected.
• Resolve the product metadata discrepancy by validating whether assets are actually Apache OFBiz, dcmtk packages, or both, and track remediation against the correct vendor advisories.