Researchers at SonicWall have recently uncovered a critical vulnerability in Apache OFBiz, designated as CVE-2023-51467. This significant security flaw enables authentication bypass and Server-Side Request Forgery (SSRF), earning a high CVSS score of 9.8. Notably, a patch previously released to address CVE-2023-49070 was found to be ineffective, inadvertently leaving the system susceptible to this new vulnerability.
Recommendations:
At OP Innovate, we strongly advise all users of Apache OFBiz to immediately upgrade to version 18.12.11. This latest version contains essential security fixes that address CVE-2023-51467, helping to safeguard against potential exploits.
Affected Versions:
- Versions of Apache OFBiz up to and including 18.12.10 are affected by CVE-2023-51467.
- Versions up to and including 18.12.9 are impacted by CVE-2023-49070.
Background:
Apache OFBiz is a widely-used, open-source Enterprise Resource Planning (ERP) system, offering versatile business solutions. The emergence of CVE-2023-51467 came to light following a patch release on December 4, 2023, for CVE-2023-49070, highlighting the need for continuous monitoring and updating of security measures.
How It Works:
The vulnerability, CVE-2023-51467, can be exploited through a specifically crafted HTTP request targeting the system’s checkLogin function. This exploit occurs when null or invalid credentials are inputted along with certain parameter settings, bypassing authentication checks and potentially leading to Remote Code Execution (RCE) on affected systems.
OP Innovate’s Guidance:
- Immediate Action: Update your Apache OFBiz installations to version 18.12.11 without delay.
- Post-Upgrade Measures: Conduct comprehensive testing and validation after upgrading to ensure all security measures are functioning correctly.
- Vigilance: Continuously monitor your systems for any signs of unusual activity or potential indicators of compromise.
Conclusion:
The discovery of CVE-2023-51467 in Apache OFBiz underscores the critical importance of maintaining diligent cybersecurity practices. We urge immediate action to apply the necessary patches and reinforce the security of your systems against this high-risk vulnerability.
Stay safe and informed,
OP Innovate Cybersecurity Team.
