Researchers have identified two vulnerabilities in Apache OFBiz is an open-source product for the automation of enterprise processes.
CVE-2023-50968: File Reading Vulnerability
The vulnerability rated as ‘important‘, CVE-2023-50968 exposes a chink in Apache OFBiz’s armor, allowing unauthorized reading of file properties and facilitating Server-Side Request Forgery (SSRF) attacks. This vulnerability is particularly insidious because it operates through an innocuous avenue: a URI call lacking proper authorizations.
An attacker exploiting this vulnerability could gain insights into the system’s internal workings, potentially leading to more severe breaches. Credit for unmasking this threat goes to security researcher Yun Peng, whose efforts have been instrumental in identifying and mitigating this risk.
Affected versions of OFBiz include all releases up to 18.12.10. Users are advised to upgrade to version 18.12.11 to secure their systems against this vulnerability.
CVE-2023-51467: Pre-authentication Remote Code Execution (RCE) vulnerability
The vulnerability CVE-2023-51467, classified as ‘critical.’ This vulnerability enables pre-authentication remote code execution (RCE), allowing attackers to bypass authentication mechanisms and directly perform SSRF attacks. The gravity of this threat cannot be overstated, as it gives attackers the potential to seize control of affected systems remotely.
All versions of Apache OFBiz prior to 18.12.11 are vulnerable to this exploit. An immediate update to version 18.12.11 is strongly recommended to close this security loophole.
