A critical authentication bypass vulnerability in Apache OFBiz allows attackers to hijack forced password-change flows and achieve remote code execution (RCE) via a single HTTP request, affecting all versions before 24.09.06.
Apache OFBiz is an open-source Enterprise Resource Planning (ERP) platform used for managing business processes.
When an administrator flags a user account with requirePasswordChange=Y, such as after a credential leak or during onboarding, that account should be locked from all functionality until a password reset is completed.
Researchers at Aretiq AI discovered that the LoginWorker.checkLogin() method fails to treat a return value of requirePasswordChange as an authentication failure.
Because the method only checks for the string “error”, a “requirePasswordChange” response from the underlying login() function is silently passed through as a successful login.
Combined with a second flaw, the requirePasswordChange flag being read directly from an attacker-controlled HTTP request parameter instead of the database, an attacker can inject the password-change flow into any protected endpoint in a single POST request.
Chaining these two authentication flaws with a third issue in ProgramExport.groovy, which, in versions before 24.09.06, lacked permission checks and a Groovy sandbox, results in full remote code execution as the OFBiz process user.
The exploit works in three steps:
In testing on OFBiz 24.09.05, a single crafted POST request to /webtools/control/ProgramExport resulted in RCE with uid=0(root).
Apache OFBiz ships with over ten demo accounts, including admin, flexadmin, demoadmin, and ltdadmin, all using the default password ofbiz.
This means that development, staging, and recently deployed production instances are trivially exploitable with no prior reconnaissance. The vulnerability is also notable for its similarity to CVE-2023-51467 , a related requirePasswordChange logic flaw scored 9.8 by MITRE/NVD.
Apache OFBiz All versions < 24.09.06 (includes entire 18.12.x branch and 24.09.x through 24.09.05) cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
Apache addressed the vulnerability in version 24.09.06 via three commits:
Network Detection (Suricata): Monitor for HTTP POST requests to /webtools/control/ProgramExport containing both requirePasswordChange=Y and groovyProgram in the request body. This combination does not appear in legitimate OFBiz usage.
Host-Based Detection (YARA): Scan LoginWorker.java for the pattern request.getParameter(“requirePasswordChange”) (vulnerable) versus userLogin.getString(“requirePasswordChange”) (patched). Scan ProgramExport.groovy for the presence or absence of SecureASTCustomizer and ENTITY_MAINT.
Immediate Mitigation Steps:
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.
Microsoft has disclosed two new zero-day vulnerabilities in Microsoft Defender that are actively being exploited…
Discord has officially enabled end-to-end encryption (E2EE) by default for all voice and video communications…
Google has released a critical security update for its Chrome browser, addressing multiple vulnerabilities that…
Hackers are actively distributing a sophisticated ValleyRAT malware variant through fake Microsoft Teams download pages,…
A large-scale malware campaign dubbed “TamperedChef” is leveraging trojanized productivity applications such as PDF editors,…
A newly discovered zero-day vulnerability in NGINX, dubbed “nginx-poolslip,” is raising serious concerns across the…
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
