Apache OFBiz RCE (CVE-2024-45195)
Description
Apache OFBiz contains a critical authentication bypass vulnerability (CVE-2024-45195) that allows remote code execution. Attackers can exploit this flaw by sending specially crafted HTTP requests to bypass authentication mechanisms entirely, gaining unauthorized administrative access to the OFBiz application without requiring valid credentials.
Remediation
Immediately upgrade Apache OFBiz to version 18.12.16 or later, which includes the security patch for CVE-2024-45195. Follow these steps:
1. Backup your current installation including all data and configurations
2. Download the patched version from the official Apache OFBiz website
3. Review the release notes at https://issues.apache.org/jira/browse/OFBIZ-13130 for migration considerations
4. Apply the upgrade following Apache OFBiz upgrade procedures
5. Verify the fix by confirming that view-maps and request-maps now properly enforce permission checks
6. Review access logs for any suspicious activity prior to patching
If immediate patching is not possible, implement network-level access controls to restrict OFBiz access to trusted IP addresses only, and monitor all authentication attempts closely until the upgrade can be completed.