Krishna Uprit

An authorization issue occurs when multitenancy is enabled, allowing a remote authenticated attacker with a low-privilege account in one tenant to read and write data from another tenant. The attacker can achieve this by providing their own `userTenantId` parameter and credentials during the Party Manager login process while targeting a hostname mapped to a different tenant. This happens because the `LoginWorker` function() prioritizes the `userTenantId` request parameter over the tenant resolved by the `ContextFilter` via `TenantDomainName`. Consequently, subsequent requests use the attacker's session identity and security object for permission checks but execute read or write operations against the data of the tenant associated with the hostname.

An issue exists where improper neutralization of special elements in a template engine leads to Server-Side Template Injection (SSTI). A remote authenticated attacker with a non-administrative account can execute arbitrary operating system commands as the OFBiz process user. This is achieved by using the `updateLayoutImage` event to write `DataResource` fields without permission checks, retyping a `DataResource` as a FreeMarker Template Language (FTL) template that evaluates its own primary key. This process allows the attacker to plant an OFBiz Form Widget where the `use-when` attribute executes unsandboxed Groovy code.

Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g., /catalog/control/ListLocales/showPortalPage), causing the servlet to authorize the request based on the public path component while rendering the protected suffix view. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplying a crafted LAST VIEW NAME value, which is stored as saved-view state in the anonymous session and later rendered without re-applying the original view's authentication requirement, potentially exposing protected views and associated business data. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including department names and identifiers, employment position names and identifiers, employee party identifiers, position occupancy, and organization relationships, via a crafted partyId parameter. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Missing Authorization in ProductEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to create, modify, or remove arbitrary product, product feature association, and product category association data by directly invoking catalog quick-admin events such as updateProductQuickAdminShipping, causing the servlet to authorize the request against the base view-level permission declared on the request-map while the underlying event methods perform entity-engine writes without checking the catalog update/create permission enforced by equivalent sibling event methods in the same class. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Incorrect Authorization in ContentPermissionServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a limited content-create permission to self-grant the OWNER role on arbitrary content by invoking the createContentRole service (e.g. via the createForumGroupRole request), causing the permission check to fall through to a fail-open default-grant branch when no ContentPurposeOperation entry matches the requested operation and content purpose, rather than denying the request. A self-granted OWNER role then satisfies the ownership check used to authorize update, removal, and status changes on that content, giving the attacker full read/write/delete control over content they should not have access to. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Missing Authorization in ProductSearchEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only catalog view permission to bulk-modify product category and feature associations across arbitrary search results by seeding a broad product search and then invoking search-result mutation events such as searchRemoveFromCategory, searchExpireFromCategory, searchAddToCategory, searchAddFeature, and searchRemoveFeature, causing the servlet to authorize the request against only the base view-level permission declared on the request-map while the underlying event methods perform bulk entity-engine deletes/inserts without checking the DELETE/CREATE permission enforced by the equivalent service-layer operations (e.g. removeProductFromCategory). Users are recommended to upgrade to version 24.09.08, which fixes this issue.

An issue exists in the entity engine's generic `performFind` service on deployments using MySQL or MariaDB. A remote unauthenticated attacker can disclose arbitrary rows from a queried entity by submitting a crafted ignore-case find request (e.g., ` ic=Y`). This occurs because the `SqlJdbcUtil.addValueSingle()` function inlines the `EntityFunction`-wrapped value directly into the SQL text using ANSI-only single-quote doubling instead of binding it as a parameter. Since MySQL and MariaDB honor backslash escapes, a backslash-terminated payload can break out of the string literal and transform the WHERE clause into a tautology, which is a statement that is always true.

XML External Entity (XXE) Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by storing a crafted text/xml DataResource containing an external entity declaration, causing ContentWorker's rendering of that content — via renderContentAsText and related CMS/help render paths — to parse the stored XML using FreeMarker's default NodeModel.parse DocumentBuilderFactory, which enables neither FEATURE SECURE PROCESSING nor external-entity/DTD restrictions, resolving the external entity and returning its content in the rendered response. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Server-Side Request Forgery in SurveyWrapper in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated back-office user holding catalog permission to cause the server to fetch and render attacker-controlled URLs — including internal network and cloud-metadata endpoints and local files via file:// — by setting an arbitrary URL as a product-store survey's template location, causing SurveyWrapper.getTemplate to call URL.openStream() on the resolved location and compile the fetched content as a FreeMarker template with no scheme or host validation, unlike the sibling widget location-loaders (ScreenFactory, FormFactory, GridFactory, MenuFactory, TreeFactory, ThemeFactory) which validate the resolved location before loading it. The fetched content is rendered into the HTTP response of any shopper who subsequently loads the affected product-store survey, making the disclosure non-blind. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Improper Authorization in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to trigger arbitrary OFBiz service invocation with attacker-controlled parameters, resulting in arbitrary file write, arbitrary file deletion, and server-side request forgery, by requesting the public showHelpPublic view against a Content row whose serviceName field an account holding only CONTENTMGR CREATE or CONTENTMGR UPDATE has set to an attacker-chosen service, causing ContentWorker.renderContentAsText to resolve the service to invoke from that persisted, client-writable field and build its parameters directly from the live HTTP request map with no allow-list, no ownership check, and no requirement that the caller be authenticated. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

An issue exists in the ViewDataFile component where a remote authenticated attacker with base webtools permissions (OFBTOOLS VIEW, WEBTOOLS VIEW) can force the server to issue arbitrary outbound HTTP requests. Attackers who also possess ENTITY MAINT and DATAFILE MAINT permissions can read arbitrary local files using a file: URL. This occurs because the `ViewDataFile.groovy` file dereferences the `DEFINITION LOCATION` and `DATAFILE LOCATION` request parameters as java.net.URL objects without a scheme allow-list, host filter, or egress control. The execution happens within a screen action that runs before permission checks for the screen and template are evaluated, allowing the fetch to execute regardless of the user's authorization to view the result.

Uncontrolled resource consumption in `ServiceMultiEventHandler` allows a remote unauthenticated attacker to pin a server request thread for a specified number of synchronous service dispatches, up to the signed-integer maximum. This occurs when a small HTTP request is submitted with parameter names encoding a row count via the `o` suffix used by multi-form submissions. The `UtilHttp.getMultiFormRowCount` function derives this count from the largest suffix without an upper bound, and `ServiceMultiEventHandler.invoke()` subsequently loops that many times calling `dispatcher.runSync()`. In a stock deployment, the request-map for `getFinAccountTransRunningTotalAndBalances` reaches this handler without requiring authentication or CSRF protection.

An authentication bypass exists in the `ExternalLoginKeysManager` due to a capture-replay flaw. A remote unauthenticated attacker who captures a live `externalLoginKey` value can obtain a complete, reusable session as the user who issued it across all accessible webapps. This occurs because the `checkExternalLoginKey()` function operates as a global preprocessor that executes before CSRF and authentication checks. The system accepts the key as a bearer credential that is not bound to a client, does not expire, and is not invalidated after use. Additionally, the framework appends live keys to cross-webapp links and allows an authenticated user's key to be sent to an attacker-controlled absolute URL via the `WidgetWorker` unvalidated inter-app link target.

Server-Side Template Injection (SSTI) occurs in the MacroScreenRenderer. A remote authenticated attacker with specific view permissions can execute arbitrary operating system commands as the OFBiz service account via a single GET request. This is possible because the `renderLink` function concatenates link parameter values verbatim between apostrophes into an unquoted and unescaped template-source string. When this string is compiled and evaluated, the injected expression reaches the `FlexibleStringExpander.expandString()` function, leading to unsandboxed code execution through runtime-assembled Groovy interpolation.

An Expression Language Injection exists in EmailServices. A remote authenticated attacker with `OFBTOOLS VIEW` and `ACCOUNTING VIEW` permissions can execute arbitrary operating system commands as the account running the software. This occurs when a `${groovy:...}` expression is submitted as the `bodyText` or `subject` value to the Send Per Email invoice form. The `sendMailFromScreen` function passes these values through `FlexibleStringExpander.expandString`, which evaluates embedded Groovy without the `SecureASTCustomizer` restrictions typically applied by `GroovyUtil.eval`.

An authorization flaw in the XmlDsDump screen action allows a remote authenticated attacker with basic webtools permissions (`OFBTOOLS VIEW`, `WEBTOOLS VIEW`) to export the contents of any database entity, such as `UserLogin` containing `currentPassword` hashes. This occurs because the action uses `FileOutputStream` to write data based on unvalidated `outpath` and `filename` request parameters before the required `ENTITY MAINT` permission check is performed. This can lead to the creation of arbitrary directories, the truncation of existing files, or the writing of sensitive data to web-served directories.

Code injection in the ModelFormField of the cms plugin allows a remote authenticated attacker with CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user. This occurs via a single HTTP POST request to the 'EditAddContent' endpoint by submitting a crafted `caContentIdTo` parameter. The CMS screen copies this parameter into a top-level context variable that is interpolated into a form field's use-when attribute, and the resulting string is passed unvalidated to the `GroovyUtil.eval()` function. The compile-time SecureASTCustomizer sandbox does not restrict runtime reflection, enabling a payload to close the expanded string literal and invoke java.lang.Runtime via reflection.

Missing authorization across the Human Resources, Catalog, and Order Manager applications allows a remote unauthenticated attacker to disclose internal business records, such as organization, employee, product catalog, and product-store data. This occurs because several helper endpoints are configured to skip authentication and perform no permission checks before returning the requested records.