About the Vulnerability
Introduction
Apache OFBiz is a business application set that is flexible enough to be used in any industry. The generic architecture allows developers to easily extend or enhance it to create custom functionalities.
Summary
On September 5, 2024, Sangfor FarSight Labs received notification that an Apache-ofbiz component contains information of Server-Side Request Forgery(SSRF) Vulnerability (CVE-2024-45507), classified as high in threat level.
Apache OFBiz contains a Server-Side Request Forgery (SSRF) vulnerability leading to Remote Code Execution. In the affected versions, due to insufficient validation of the loaded resource paths by the GroovyUtil, ScriptUtil, and ScreenFactory classes, attackers can trigger remote code execution by inputting URLs to load remote Groovy scripts and Screen resources.
Affected Versions
Apache OFBiz < 18.12.16
Solutions
Remediation Solutions
Check the System Version
You can check the current version on the bottom right corner of the web page of Apache-ofbiz.
Official Solution
Affected users are strongly advised to update the version of OfBIZ.
Download link: https://ofbiz.apache.org/download.html
Sangfor Solutions
Risky Assets Detection
Support is provided for proactive detection of Apache-ofbiz; and it is capable of batch identifying the affected asset conditions of this event in business scenarios. Related products are as follows:
[Sangfor CWPP] has released an asset detection scheme, with Fingerprint ID: 0004890.
[Sangfor Host Security] has also released an asset detection scheme, with Fingerprint ID: 0004890.
Vulnerability Proactive Detection
Support is provided for proactive detection of Apache OFBiz Server-Side Request Forgery Vulnerability (CVE-2024-45507); and it is capable of quickly batch identifying whether there are vulnerability risks in business scenarios. Related products are as follows:
[Sangfor Host Security] is expected to release a detection scheme on September 12, 2024 with Rule ID: SF-2024-00672.
[Sangfor Cyber Guardian MDR]is expected to release a detection scheme on September 12, 2024 with Rule ID: SF-2024-00672.
[Sangfor Omni-Command] is expected to release a detection scheme on September 12, 2024 (requiring Host Security component capabilities), with Rule ID: SF-2024-00672.
Timeline
On September 5, 2024, Sangfor FarSight Labs received notification of Apache OFBiz Server-Side Request Forgery vulnerability.
On September 5, 2024, Sangfor FarSight Labs released a vulnerability alert.
References
https://ofbiz.apache.org/security.html https://github.com/apache/ofbiz-framework/commit/28f5f87ec9 https://issues.apache.org/jira/browse/OFBIZ-13132
