A zero-day pre-authentication remote code execution vulnerability , identified as CVE-2024-38856, has been discovered in the Apache OFBiz open-source enterprise resource planning (ERP) system. This critical flaw could allow threat actors to execute remote code on affected instances, posing significant risks to businesses relying on this software.

Vulnerability Overview

• Vulnerability Type: Zero-day pre-authentication remote code execution
• CVSS Score: 9.8/10
• Affected Versions: Apache OFBiz versions prior to 18.12.15

The vulnerability stems from a flaw in the authentication mechanism of Apache OFBiz. This flaw enables unauthenticated users to access functionalities that typically require a login, paving the way for remote code execution.

The exploit is particularly dangerous as it allows threat actors to bypass authentication protections by chaining the ProgramExport endpoint with other endpoints that do not require authentication, leveraging the override view functionality. This method grants attackers unauthorised access to critical endpoints via specially crafted requests.

Patch and Mitigation:

CVE-2024-38856 is also a patch bypass for an earlier vulnerability, CVE-2024-36104, a path traversal issue that was addressed in June 2024 with the release of Apache OFBiz version 18.12.14. Administrators should immediately update to version 18.12.15 or later to mitigate this severe risk.

Recommendations:

• Update Immediately: Ensure your Apache OFBiz instances are updated to version 18.12.15 or later.
• Monitor for Unusual Activity: Watch for any signs of exploitation or unauthorised access attempts.
• Review Security Practices: Regularly review and update security measures to protect against similar vulnerabilities in the future.

The discovery of CVE-2024-38856 highlights the critical importance of staying up-to-date with security patches and continuously monitoring for vulnerabilities. As threat actors increasingly target known weaknesses in widely used systems like Apache OFBiz, proactive security measures are essential to protect your organisation’s data and resources.

For tailored solutions to safeguard your business from cybersecurity threats, contact our team today .

Fill out the form below to get started, and let our experts help you enhance your cybersecurity posture. 👇