CVE-2024-32113
Apache OFBiz Path Traversal Vulnerability
Description
CVE-2024-32113 is a critical path traversal vulnerability in Apache OFBiz with a CVSS v3.1 base score of 9.8. The flaw allows an unauthenticated remote attacker to traverse file system paths and potentially execute arbitrary code on the server running OFBiz. CISA has added CVE-2024-32113 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of August 28, 2024, and its ransomware association is classified as unknown. With an exceptionally high EPSS score of 93.93% at the 99.9th percentile, this is one of the most actively exploited vulnerabilities in existence. The vulnerability affects Apache OFBiz versions prior to 18.12.13.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apache | ofbiz | < 18.12.13 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- http://www.openwall.com/lists/oss-security/2024/05/09/1(Mailing List)
- https://issues.apache.org/jira/browse/OFBIZ-13006(Vendor Advisory)
- https://lists.apache.org/thread/w6s60okgkxp2th1sr8vx0ndmgk68fqrd(Mailing List)
- https://ofbiz.apache.org/download.html(Product)
- https://ofbiz.apache.org/security.html(Patch)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-32113(Third Party Advisory, US Government Resource)
Weakness Type
Path Traversal in Apache OFBiz
CVE-2024-32113 is a path traversal vulnerability (also known as directory traversal) in Apache OFBiz, an open-source enterprise resource planning (ERP) system. Path traversal vulnerabilities allow attackers to access files and directories outside the intended web application directory by manipulating file path references in HTTP requests. In OFBiz, the application fails to properly sanitize or validate file path inputs, enabling an attacker to use sequences such as ../ to navigate the server's file system and access sensitive files, configuration data, or execute arbitrary code. Path traversal in enterprise applications is particularly dangerous because ERP systems typically have access to databases containing financial records, customer data, human resources information, and other highly sensitive business data.
Learn more about path traversal vulnerabilities: CWE-22: Improper Limitation of a Pathname to a Restricted Directory
Impact Analysis
The business impact of CVE-2024-32113 is catastrophic, achieving the maximum CVSS base score of 9.8 with high impact across all dimensions. Confidentiality is fully compromised (C:H) because path traversal enables the attacker to read arbitrary files on the server, including OFBiz configuration files containing database credentials, API keys, encryption secrets, and any business data stored in accessible file paths. As an ERP system, OFBiz typically manages financial transactions, inventory, customer records, and employee data.
Integrity faces maximum impact (I:H) because the path traversal can be leveraged to write or modify files on the server, potentially leading to web shell deployment, configuration tampering, or code injection. An attacker who can write to the OFBiz application directory can deploy persistent backdoors that survive application restarts.
Availability is fully at risk (A:H) as the attacker can corrupt application files, delete critical data, or deploy ransomware on the server. The network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N) create the worst-case scenario for exploitation. The EPSS score of 93.93% at the 99.9th percentile confirms that this vulnerability is being exploited at an extreme rate, reflecting both the severity of the flaw and the internet-exposed nature of many OFBiz installations.
Exploit Maturity
CVE-2024-32113 has reached maximum exploit maturity with confirmed widespread active exploitation and near-universal exploitation probability. CISA has included it in the Known Exploited Vulnerabilities catalog with a remediation deadline of August 28, 2024. The EPSS score of 93.93% at the 99.9th percentile places it among the most exploited vulnerabilities ever tracked, indicating near-certain exploitation against any exposed instance.
The vulnerability was publicly disclosed through the Apache OFBiz security advisory and discussed on the oss-security mailing list. The Apache JIRA issue OFBIZ-13006 tracks the technical details of the fix. The combination of unauthenticated access, network reachability, and the critical nature of ERP systems makes this vulnerability an extremely high-value target for both opportunistic and targeted attackers. The ransomware association is classified as unknown, but the server-level access gained through exploitation is directly suitable for ransomware deployment on enterprise systems.
Remediation
-
Upgrade Apache OFBiz to version 18.12.13 or later immediately. Download the patched version from the official Apache OFBiz download page. Given the near-maximum EPSS score, any unpatched internet-facing OFBiz instance should be considered at imminent risk of compromise.
-
Isolate OFBiz instances from direct internet access. Place OFBiz deployments behind a web application firewall (WAF) and reverse proxy that can inspect and filter path traversal attempts. Configure WAF rules to block requests containing path traversal sequences such as
../,..\,%2e%2e/, and URL-encoded variants. -
Assume compromise if the system was exposed while vulnerable. Any OFBiz instance running a version prior to 18.12.13 that was accessible from untrusted networks should undergo a thorough forensic investigation. Check for web shells, unauthorized file modifications, new user accounts, and unusual outbound network connections. Review OFBiz access logs for path traversal patterns.
-
Rotate all credentials and secrets stored in OFBiz. After patching, change all database passwords, API keys, SMTP credentials, and any other secrets stored in OFBiz configuration files. The path traversal vulnerability would have allowed attackers to read these configuration files directly.
-
Implement network segmentation for the OFBiz database. Ensure the database server used by OFBiz is not directly accessible from the internet and that database connections are restricted to the OFBiz application server only. This limits the blast radius if the application server is compromised through this or future vulnerabilities.
Technical Details
CVE-2024-32113 carries a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, resulting in a critical base score of 9.8. This represents the most dangerous combination of attack characteristics: network accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N).
The vulnerability is a path traversal flaw in Apache OFBiz's request handling logic. OFBiz is a Java-based ERP application that processes HTTP requests through a series of servlets and filters. The vulnerable component fails to properly validate or canonicalize file path parameters in certain request handlers, allowing an attacker to inject directory traversal sequences that escape the intended web application root directory. By crafting HTTP requests with path manipulation payloads, the attacker can read arbitrary files from the server's file system, including /etc/passwd, application configuration files containing database credentials, and Java keystores. In more severe exploitation scenarios, the path traversal can be combined with file write capabilities or other OFBiz features to achieve remote code execution on the server. The scope is unchanged (S:U), but the impact of compromising an ERP system extends far beyond the server itself, as the business data and integrations managed by OFBiz affect the entire organization. The fix in version 18.12.13 adds proper path validation and canonicalization to prevent traversal outside the intended directories.
Frequently Asked Questions
What is CVE-2024-32113?
CVE-2024-32113 is a critical path traversal vulnerability in Apache OFBiz that allows an unauthenticated remote attacker to access files outside the intended application directory, potentially leading to arbitrary code execution. It has a CVSS v3.1 score of 9.8 and an EPSS score of 93.93%.
Which versions of Apache OFBiz are affected?
All versions of Apache OFBiz prior to 18.12.13 are affected by CVE-2024-32113. Users should upgrade to version 18.12.13 or later, which is available from the official Apache OFBiz download page.
How critical is CVE-2024-32113 for internet-facing OFBiz instances?
Extremely critical. The combination of unauthenticated network access, low exploitation complexity, and a 93.93% EPSS score means any internet-exposed OFBiz instance running a version before 18.12.13 is at near-certain risk of being exploited. Immediate patching or isolation is essential.
Can a WAF protect against CVE-2024-32113?
A properly configured WAF can provide temporary mitigation by blocking path traversal patterns in HTTP requests. However, WAF rules can sometimes be bypassed through encoding tricks or application-specific evasion techniques. Upgrading OFBiz to the patched version is the only reliable remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.