Apache OFBiz: Arbitrary file properties reading and SSRF attack

Vulnerability

In Apache OFBiz versions through 18.12.10, unauthenticated users can perform a URI call that reads arbitrary file properties and enables Server-Side Request Forgery (SSRF)[3]. The vulnerability is due to missing authorization checks on certain URI handlers.

Exploitation

An attacker can craft a malicious URI without authentication to trigger the vulnerability. No user interaction is required. The same URI can be used to perform SSRF attacks, allowing the attacker to make requests to internal or external systems[3].

Impact

Successful exploitation allows arbitrary file properties reading, potentially leaking sensitive information such as file existence or metadata. SSRF can be leveraged to probe internal networks or access internal services, leading to further compromise[3].

Mitigation

The vulnerability is fixed in Apache OFBiz version 18.12.11[3]. The fix is tracked in Jira issue OFBIZ-12875[4]. Users are recommended to upgrade to the latest release. No workarounds are provided.