Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE

Vulnerability

Apache OFBiz versions from 18.12.17 up to, but not including, 18.12.18 contain a regression that introduces improper neutralization of special elements used in a template engine (server-side template injection). The official release 18.12.17 is *not* affected; only builds or artifacts that fall *between* the 18.12.17 and 18.12.18 tags are vulnerable. The project strongly discourages using non-official builds [1].

Exploitation

An attacker must be able to supply untrusted input that reaches a FreeMarker template engine interpolation. In affected builds, the fix for OFBIZ-12594 (which prevented FreeMarker interpolation in fields) was partially reverted or not fully applied, allowing special template syntax to be injected. No authentication is required if the vulnerable code path is exposed to unauthenticated requests, though the exact entry point is not fully detailed in the available references [2].

Impact

Successful exploitation allows an attacker to achieve remote code execution (RCE) by injecting FreeMarker directives and expressions. Because FreeMarker template access can execute arbitrary Java code, the attacker gains control of the OFBiz server process, leading to full compromise of confidentiality, integrity, and availability.

Mitigation

Users should upgrade to Apache OFBiz release 18.12.18, which properly restores the template interpolation fix [1]. Organizations must ensure they only use official released versions; no workaround is available for custom snapshot builds. As of publication, this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.