\u00a0Introduction<\/p>\n

On December 26, 2023, researchers at SonicWall announced the discovery of a zero-day security flaw in Apache OFBiz. Tracked as CVE-2023-51467, the vulnerability allows threat actors to bypass authentication and perform a Server-Side Request Forgery (SSRF). CVE-2023-51467 earned a critical CVSS score of 9.8. According to researchers at SonicWall, a patch released for another vulnerability, CVE-2023-49070, left the initial issue unresolved, making authentication bypass possible.
\nRecommendations<\/p>\n

Zscaler ThreatLabz strongly advises users of Apache OFBiz software to promptly upgrade to version 18.12.11, as this version contains crucial fixes to mitigate the identified security vulnerability (CVE-2023-51467).
\nAffected Versions<\/p>\n

The following versions of Apache OFBiz are affected by the disclosed vulnerabilities and should be updated immediately: <\/p>\n

\tAll versions 18.12.10 and below are impacted by CVE-2023-51467
\n\tAll versions 18.12.9 and below are impacted by CVE-2023-49070<\/p>\n

Background<\/p>\n

Apache OFBiz is an open-source Enterprise Resource Planning (ERP) system that provides business solutions for various industries. This includes tools to manage operations like customer relationships, order processing, human resource functions, and warehouse management.<\/p>\n

On December 4, 2023, Apache released a patch to fix CVE-2023-49070. For this fix, Apache removed the XMLRPC endpoint and the OFBiz XMLRPC library, which was not maintained regularly. However, this fix didn\u2019t resolve the root cause of CVE-2023-49070.<\/p>\n

While validating the fix for CVE-2023-49070, researchers from SonicWall bypassed authentication in the newly fixed version of Apache OFBiz, leading to CVE-2023-51467.
\nHow It Works<\/p>\n

A threat actor sends an HTTP request to exploit a flaw in the checkLogin function. When null or invalid username and password parameters are supplied and the requirePasswordChange parameter is set to Y in the URI, the checkLogin function fails to validate the credentials, leading to authentication bypass. This occurs because the program flow circumvents the conditional block meant to check the username and password fields. By manipulating login parameters, threat actors can achieve Remote Code Execution (RCE) on a target server.
\nZscaler Best Practices<\/p>\n

\tSafeguard crown jewel applications by limiting lateral movement using Zscaler Private Access\u2122 with application security modules turned on.
\n\tRoute all server traffic through Zscaler Private Access\u2122 with the application security module enabled and Zscaler Internet Access\u2122, which provides visibility to identify and stop malicious activity from compromised systems\/servers.
\n\tTurn on Zscaler Advanced Threat Protection\u2122 to block all known command-and-control domains \u2014 thereby adding another layer of protection if an attacker exploits this vulnerability to implant malware.
\n\tExtend command-and-control (C2) protection to all ports and protocols with Zscaler Cloud Firewall\u2122 (Cloud IPS module), including emerging C2 destinations. Doing so provides additional protection if the attacker exploits this vulnerability to implant malware.
\n\tUse Zscaler Cloud Sandbox\u2122 to prevent unknown malware delivered as part of a second-stage payload.
\n\tInspect all TLS\/SSL traffic and restrict traffic to critical infrastructure from an allowed list of known-good destinations.<\/p>\n

Conclusion<\/p>\n

Apache OFBiz systems should promptly be updated to version 18.12.11. Failing to do so leaves systems vulnerable to CVE-2023-51467, allowing threat actors to manipulate login parameters and execute arbitrary code on the target server.
\nZscaler Coverage<\/p>\n

The Zscaler ThreatLabz team has deployed the following.<\/p>\n

Zscaler Advanced Threat Protection<\/p>\n

\tAPP.EXPLOIT.CVE-2023-49070
\n\tAPP.EXPLOIT.CVE-2023-51467<\/p>\n

Zscaler Private Access AppProtection<\/p>\n

\t6000751 – Apache OFBiz XMLRPC Insecure Deserialization (CVE-2023-49070)
\n\t6000753 – Apache OFBiz Auth Bypass and Code Injection (CVE-2023-51467)<\/p>\n

For more details, visit the Zscaler Threat Library.
\nReferences<\/p>\n

\thttps:\/\/blog.sonicwall.com\/en-us\/2023\/12\/sonicwall-discovers-critical-apache-ofbiz-zero-day-authbiz\/
\n\thttps:\/\/threatprotect.qualys.com\/2023\/12\/27\/apache-ofbiz-authentication-bypass-vulnerability-cve-2023-51467\/
\n\thttps:\/\/lists.apache.org\/thread\/9tmf9qyyhgh6m052rhz7lg9vxn390bdv\u00a0<\/p>","protected":false},"excerpt":{"rendered":"

Introduction On December 26, 2023, researchers at SonicWall announced the […]<\/p>\n","protected":false},"author":0,"featured_media":2086,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11],"tags":[],"class_list":["post-2085","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-zenith-zscaler"],"yoast_head":"\n