CVE-2024-45195

What it actually does

Apache OFBiz before 18.12.16 contains a direct request, or forced browsing, authorization bypass that allows an unauthenticated remote attacker to request protected controller/view functionality directly instead of reaching it through the intended authenticated workflow. In practical exploitation, exposed OFBiz web interfaces can be abused to reach administrative WebTools actions such as ProgramExport and submit server-side script content, which may result in unauthorized access to sensitive application functions and, in commonly observed exploit chains, remote command execution under the OFBiz application account.

Why it matters to the business

Successful exploitation can give an external attacker control over an OFBiz application that often supports ERP, order management, inventory, accounting, customer, or supply-chain workflows. Consequences can include service disruption, theft or modification of business data, creation of unauthorized accounts, deployment of web shells or malware, and use of the server as a foothold for lateral movement. This vulnerability is listed in CISA KEV, has active in-the-wild exploitation, and has an extremely high EPSS score of 0.99983, so internet-exposed OFBiz systems should be treated as high-priority remediation targets even though it is not currently marked by CISA as ransomware-associated. CISA’s KEV remediation due date was 2025-02-25, so any remaining exposure is overdue by federal KEV standards.

How an attack unfolds

An attacker first scans for internet-accessible Apache OFBiz instances, commonly by identifying OFBiz login, WebTools, or control endpoints. Against versions before 18.12.16, the attacker crafts direct requests to protected routes that should require authentication but can be reached through forced browsing. Public exploitation commonly focuses on WebTools control paths such as ProgramExport, sometimes reached through unexpected unauthenticated paths involving forgotPassword routing. The attacker submits crafted parameters containing server-side script or command-execution logic. If the instance is vulnerable, OFBiz processes the request in a privileged application context, allowing the attacker to run commands, write files, stage a web shell, download second-stage tooling, create persistence, or access sensitive ERP data. After initial execution, the attacker typically enumerates the host, reviews OFBiz configuration and database connection material, harvests credentials, and pivots to other internal services reachable from the application server.

How to fix it

Upgrade Apache OFBiz to 18.12.16 or later. For source-based deployments using apache/ofbiz-framework, ensure the codebase includes commit 1c94327c9930510984c23cb49abdd4da2376b33e or a later upstream revision containing the fix. For packaged Red Hat RHEL EUS 8.4 AppStream components listed in the advisory data, update fapolicyd, fapolicyd-debuginfo, fapolicyd-debugsource, and fapolicyd-selinux to 0:1.0.2-6.el8_4.1 where applicable. Because this issue is actively exploited, patching should be accompanied by incident review, not treated as a routine maintenance-only update. If immediate upgrade is not possible, restrict OFBiz access to trusted networks or VPNs, block public access to /webtools/ and administrative /control/ paths, enforce reverse-proxy allowlists, disable unnecessary WebTools functionality, and monitor for direct requests to protected endpoints. WAF rules can reduce opportunistic exploitation but should not be considered a substitute for upgrading.

How to confirm the fix worked

Confirm the deployed Apache OFBiz version is 18.12.16 or later, or verify the source tree contains fixed commit 1c94327c9930510984c23cb49abdd4da2376b33e or later. Review build artifacts, container images, and running application banners/configuration to ensure the running instance—not only the repository—has been updated. Attempt to access previously protected WebTools/controller routes from an unauthenticated session and confirm they return an authentication or authorization denial rather than executing the requested action. Validate that public network paths cannot directly reach OFBiz administrative endpoints unless explicitly required. For Red Hat-managed packages in scope, confirm the installed package version is 0:1.0.2-6.el8_4.1 or later using the platform package manager. After patching, restart OFBiz and any dependent services, then re-run vulnerability scanning and review access logs for continued exploit attempts.

Typical attack path

1. Scan for exposed Apache OFBiz HTTP/S services and identify WebTools or /control/ endpoints.
2. Fingerprint the OFBiz version or test for vulnerable routing behavior affecting versions before 18.12.16.
3. Send a crafted direct request to a protected OFBiz controller/view that should require authentication, commonly involving WebTools ProgramExport-style functionality.
4. Submit malicious script or command content through accepted request parameters.
5. Execute operating-system commands in the context of the OFBiz application process if the exploit chain succeeds.
6. Download or write follow-on payloads such as web shells, shell scripts, miners, remote access tools, or credential harvesters.
7. Collect OFBiz configuration files, database credentials, application data, and session material.
8. Establish persistence, conceal activity, and use the compromised server for lateral movement or further attacks.

How to detect it

Review HTTP access logs from OFBiz, reverse proxies, load balancers, WAFs, and CDN layers for unauthenticated requests to WebTools and control endpoints, especially paths containing ProgramExport, forgotPassword, or unusual chained route segments. Correlate these requests with OFBiz application logs for errors, Groovy/script execution, export activity, stack traces, or controller authorization anomalies. On the host, review EDR and process telemetry for the OFBiz Java process spawning shell or scripting utilities such as sh, bash, cmd.exe, powershell.exe, curl, wget, python, perl, nc, or busybox. Inspect OFBiz installation directories, web-accessible paths, runtime/work directories, and temporary directories for newly created JSPs, scripts, archives, or binaries. Review outbound network logs for connections shortly after suspicious HTTP requests, particularly downloads from unknown IPs or connections to high-risk ports. Examine authentication, user-management, and administrative logs for newly created users or configuration changes following suspicious requests. If known exploitation is suspected, collect memory/process listings, file timelines, command history where available, OFBiz logs, proxy logs, and network flow data before remediation actions overwrite evidence.

• /webtools/control/ProgramExport
• /webtools/control/forgotPassword/ProgramExport
• /webtools/control/forgotPassword
• /webtools/control/main/ProgramExport
• ProgramExport
• groovyProgram
• POST /webtools/control/ProgramExport
• POST /webtools/control/forgotPassword/ProgramExport
• GET /webtools/control/forgotPassword/ProgramExport
• /control/forgotPassword/ProgramExport
• java child process: /bin/sh
• java child process: /bin/bash
• java child process: cmd.exe
• java child process: powershell.exe
• java child process: curl
• java child process: wget
• bash -c
• sh -c
• powershell -enc
• curl http://
• wget http://
• nc -e
• /tmp/ofbiz
• /tmp/*.sh
• /tmp/*.jsp
• /opt/ofbiz/runtime/
• /opt/ofbiz/framework/webtools/
• /opt/ofbiz/applications/

What your security team should do

• Immediately inventory all Apache OFBiz instances, including internet-facing hosts, containers, test systems, and embedded/downstream deployments.
• Prioritize emergency upgrade of all OFBiz deployments before 18.12.16, especially any reachable from the internet.
• Because this is KEV-listed and actively exploited with very high EPSS, perform compromise assessment on vulnerable or previously exposed systems before returning them to normal trust.
• Restrict external access to OFBiz WebTools and administrative /control/ endpoints using VPN, IP allowlisting, reverse proxy policy, or network segmentation.
• Search historical web, application, EDR, and proxy logs for ProgramExport, forgotPassword/ProgramExport, groovyProgram, suspicious command strings, and outbound payload downloads.
• Review OFBiz configuration files, user accounts, scheduled jobs, webroot directories, and temporary directories for unauthorized changes or newly written files.
• Rotate credentials accessible to the OFBiz process, including database credentials, API keys, service accounts, and administrative passwords, if exploitation cannot be ruled out.
• Add SIEM detections for unauthenticated requests to sensitive OFBiz control paths and for OFBiz-spawned shell, scripting, or download utilities.
• Preserve forensic evidence before rebuilding or cleaning systems where suspicious exploitation artifacts are found.
• Track Apache OFBiz advisories for related authorization bypass and RCE fixes, as this vulnerability is part of a pattern of actively targeted OFBiz flaws.