Hasib Vhora

**Name of the Vulnerable Software and Affected Versions** Apache OFBiz versions prior to 18.12.16 **Description** The issue is a Direct Request ('Forced Browsing') vulnerability in Apache OFBiz, which could allow attackers to execute arbitrary code on vulnerable Linux and Windows servers. This vulnerability has been actively exploited by hackers, with over 25,000 requests targeting 4,000 unique sites detected by Imperva. The vulnerability allows for unauthenticated remote code execution. **Recommendations** Apache OFBiz versions prior to 18.12.16: Upgrade to version 18.12.16 to prevent attacks. As a temporary workaround, consider restricting access to vulnerable modules or functions until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Apache OFBiz versions through 18.12.14 **Description** This issue affects Apache OFBiz, allowing unauthenticated endpoints to execute screen rendering code of screens if certain preconditions are met, such as when screen definitions do not explicitly check user permissions. The vulnerability is related to incorrect authorization and can lead to remote code execution. It is being actively exploited, and proof-of-concept exploits are available. Users are recommended to upgrade to version 18.12.15 to fix the issue. **Recommendations** Apache OFBiz versions through 18.12.14: Upgrade to version 18.12.15 to resolve the issue. As a temporary workaround, consider restricting access to unauthenticated endpoints to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Apache OFBiz versions prior to 18.12.11 **Description** The vulnerability allows attackers to bypass authentication processes, enabling them to remotely execute arbitrary code. This issue is related to insufficient validation of incoming requests. The estimated number of potentially affected devices worldwide is around 65,041, mainly distributed in the United States, Japan, and other countries. There have been real-world incidents where this issue was exploited, with researchers creating proof-of-concept (PoC) exploits. Technical details about exploitation include the use of API endpoints such as `/webtools/control/xmlrpc/` and vulnerable parameters like `USERNAME` and `PASSWORD`. The `checkLogin()` function is also vulnerable, allowing attackers to bypass authentication by setting `requirePasswordChange=Y` in the URI. **Recommendations** Update to Apache OFBiz version 18.12.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoints, such as `/webtools/control/xmlrpc/`, until a patch is applied. Additionally, avoid using the `requirePasswordChange` parameter in the URI until the issue is resolved.