Apache OFBiz: Path traversal allowing authentication bypass.

Vulnerability

A path traversal vulnerability exists in Apache OFBiz's hasBasePermission method within LoginWorker. The contextPath parameter is not normalized, allowing an attacker to bypass authentication checks. Affected versions are Apache OFBiz before 18.12.12 [1][2][4].

Exploitation

An attacker can send a crafted HTTP request with a malicious contextPath (e.g., containing directory traversal sequences like ../) to bypass authentication. No prior authentication or special network position is required; the vulnerability is exploitable remotely [4].

Impact

Successful exploitation allows an attacker to bypass authentication mechanisms, gaining unauthorized access to OFBiz instances. This can lead to full compromise of the application, including data disclosure and potential admin-level access [1][4].

Mitigation

Users should upgrade to Apache OFBiz version 18.12.12 (released February 2024) which fixes the issue. No workarounds are available. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date [2][4].