An important update was made by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday when they included a severe security vulnerability affecting the Apache OFBiz open-source enterprise resource planning (ERP) system in the Known Exploited Vulnerabilities (KEV) catalog. This action was taken due to evidence suggesting ongoing exploitation of this vulnerability.
The identified vulnerability, named as CVE-2024-38856, has been assigned a critical severity rating with a CVSS score of 9.8.
“There exists an incorrect authorization vulnerability in Apache OFBiz that could potentially lead to remote code execution through a Groovy payload within the context of the OFBiz user process by an unauthorized attacker,” as stated by CISA.
The details about this vulnerability were brought to public attention earlier this month after SonicWall identified it as a method to bypass a different flaw, CVE-2024-36104, enabling the execution of remote code via specifically crafted requests.
Highlighting this, SonicWall researcher Hasib Vhora mentioned, “A vulnerability in the override view function exposes crucial endpoints to threat actors without authentication, thereby creating a pathway for remote code execution.”
This update follows shortly after CISA included a third flaw affecting Apache OFBiz (CVE-2024-32113) in the KEV catalog, subsequent to reports indicating its exploitation in propagating the Mirai botnet.
Although there are no public reports so far on the methods of exploitation related to CVE-2024-38856, proof-of-concept (PoC) exploits have been shared publicly.
The fact that two Apache OFBiz flaws are being actively exploited signifies the growing interest and readiness of attackers to take advantage of known vulnerabilities to infiltrate vulnerable systems maliciously.
It is highly advised for organizations to update to version 18.12.15 as a preventive measure against this threat. Moreover, the Federal Civilian Executive Branch (FCEB) has been directed to apply the required updates by September 17, 2024.
About Author
