CVE-2024-32113

What it actually does

CVE-2024-32113 is a pre-authentication path traversal vulnerability in Apache OFBiz before 18.12.13. By crafting a URL that traverses from an unauthenticated controller route into a restricted OFBiz endpoint, an attacker can bypass intended access controls and reach administrative or developer functionality that should require authentication. In practical exploitation, this can expose sensitive application functions and has been widely used to achieve remote code execution through OFBiz webtools functionality, resulting in full compromise of the OFBiz application process and its reachable data, integrations, and host-level privileges.

Why it matters to the business

Successful exploitation can allow an unauthenticated internet-based attacker to take control of an Apache OFBiz deployment, steal business data, alter transactions or application configuration, disrupt operations, and use the server as a foothold for broader intrusion. The vulnerability has a critical CVSS score, a very high EPSS probability, is listed in CISA KEV with a remediation due date of 2024-08-28, and is known to be actively exploited in the wild, making unpatched internet-facing OFBiz systems high-priority assets for immediate remediation.

How an attack unfolds

An attacker first identifies an Apache OFBiz instance exposed over HTTP or HTTPS. They then send a specially crafted request containing path traversal sequences to an unauthenticated OFBiz route, causing OFBiz routing or authorization logic to resolve the request to a restricted endpoint such as webtools functionality. Because the authorization decision can be made on the apparent unauthenticated path rather than the final resolved endpoint, the attacker gains access to functionality that should not be reachable without login. Public exploitation has commonly targeted webtools endpoints capable of evaluating Groovy or invoking administrative functions, allowing the attacker to run operating system commands under the OFBiz Java process. After code execution, the attacker may retrieve configuration files, database credentials, deploy web shells, create persistence, download additional tooling, or pivot to connected systems.

How to fix it

Upgrade Apache OFBiz to version 18.12.13 or later. For source-based deployments using apache/ofbiz-framework, ensure the fix commit 2f4d1acdb93c274eb94ead7890b64dd383cb3dad or a later secure revision is present. Because later OFBiz vulnerabilities have also affected related authorization and routing behavior, prefer upgrading to the latest supported Apache OFBiz release rather than only applying the minimum patch. If immediate upgrade is not possible, restrict external access to OFBiz, block direct access to /webtools/control/ and other administrative routes at a reverse proxy or WAF, require VPN or trusted network access for administrative interfaces, disable unneeded webtools functionality, and monitor for traversal attempts. Mitigations should be treated as temporary because this vulnerability is actively exploited and pre-authentication.

How to confirm the fix worked

Confirm the running Apache OFBiz version is 18.12.13 or later, or verify that the deployed source includes commit 2f4d1acdb93c274eb94ead7890b64dd383cb3dad or later. Review build artifacts, container images, package manifests, and deployment pipelines to ensure older OFBiz libraries or source trees are not still in use. From a controlled test system, verify that unauthenticated requests using traversal sequences such as /webtools/control/forgotPassword/../ProgramExport, encoded variants, or semicolon-normalization variants are rejected with an authentication or authorization failure and do not reach restricted endpoints. Confirm that administrative endpoints such as /webtools/control/ are not internet-accessible unless explicitly required and protected. Review reverse proxy, WAF, and application logs after patching to ensure attempted traversal requests are blocked and not processed by OFBiz.

Typical attack path

1. Scan for exposed Apache OFBiz web interfaces, commonly on HTTP or HTTPS application ports.
2. Fingerprint OFBiz by requesting known paths such as /webtools/control/ or other OFBiz application routes.
3. Send a crafted URL containing traversal patterns such as ../ or encoded equivalents from an unauthenticated route into a restricted OFBiz endpoint.
4. Invoke privileged webtools or administrative functionality without valid credentials.
5. Submit a command-execution payload, commonly through Groovy-capable functionality such as ProgramExport where exposed.
6. Execute reconnaissance commands from the OFBiz Java process to identify user context, filesystem access, network access, and stored credentials.
7. Exfiltrate application secrets, database credentials, business data, or configuration files.
8. Establish persistence or deploy follow-on malware, web shells, reverse shells, or lateral-movement tooling.

How to detect it

Review web server, reverse proxy, WAF, and Apache OFBiz application logs for unauthenticated requests containing traversal sequences that target restricted OFBiz routes, especially webtools endpoints. Pay particular attention to requests combining an unauthenticated path such as forgotPassword with ../, %2e%2e, ..;, encoded slashes, or ProgramExport, and to POST bodies containing Groovy code or parameters such as groovyProgram. Correlate suspicious requests with HTTP 200, 302, or application error responses that indicate the request reached OFBiz rather than being blocked. On hosts, review EDR, auditd, Sysmon, shell history, process accounting, and container runtime logs for child processes spawned by the OFBiz Java process, including /bin/sh, bash, cmd.exe, powershell.exe, curl, wget, python, perl, nc, ncat, or openssl. Inspect OFBiz directories for newly created JSPs, modified templates, unexpected JARs, scripts, cron jobs, systemd services, SSH keys, and outbound network connections shortly after suspicious HTTP requests. If exploitation is suspected, collect memory/process data and preserve OFBiz logs before restarting or redeploying, then rotate application, database, and integration credentials accessible to the OFBiz process.

• /webtools/control/forgotPassword/../ProgramExport
• /webtools/control/forgotPassword/%2e%2e/ProgramExport
• /webtools/control/forgotPassword/..;/ProgramExport
• /webtools/control/forgotPassword/%2e%2e%2fProgramExport
• /webtools/control/forgotPassword/%252e%252e%252fProgramExport
• /webtools/control/forgotPassword/..%2fProgramExport
• /webtools/control/ProgramExport
• groovyProgram=
• ProgramExport?groovyProgram=
• /webtools/control/forgotPassword/../
• /webtools/control/forgotPassword/%2e%2e
• /webtools/control/forgotPassword/..;
• ../ProgramExport
• %2e%2e/ProgramExport
• ..;/ProgramExport
• java.lang.ProcessBuilder
• Runtime.getRuntime().exec
• /bin/sh -c
• cmd.exe /c
• powershell.exe -Command
• curl http://
• wget http://
• nc -e
• ncat -e

What your security team should do

• Immediately inventory all Apache OFBiz deployments, including source builds, containers, appliances, and embedded downstream applications.
• Prioritize patching internet-facing OFBiz instances to 18.12.13 or later, preferably the latest supported OFBiz release.
• Treat any unpatched externally reachable instance as potentially compromised and perform incident response review, not just patching.
• Apply temporary network controls to restrict /webtools/control/ and administrative OFBiz paths to trusted management networks only.
• Add WAF or reverse-proxy rules for traversal attempts containing ../, %2e%2e, ..;, encoded slashes, and requests to ProgramExport or other webtools endpoints from unauthenticated clients.
• Hunt historical logs for exploitation attempts and successful responses involving webtools traversal and Groovy payload parameters.
• Review OFBiz host telemetry for suspicious child processes spawned by Java, including shell, PowerShell, curl, wget, Python, Perl, or netcat.
• Rotate credentials stored in OFBiz configuration files or accessible to the OFBiz process if exploitation is suspected.
• Check for unauthorized files, web shells, modified OFBiz templates, unexpected scheduled jobs, new users, or persistence mechanisms.
• Because this vulnerability is in CISA KEV and actively exploited, track remediation to completion with executive visibility and deadline enforcement.