Apache OFBiz Pre-Auth Remote Code Execution (CVE-2024-38856)

CVE-2024-38856 is an unauthenticated remote code execution flaw in Apache OFBiz ERP/CRM. Attackers hit the web console with crafted requests and execute arbitrary code as the Tomcat/Java process user — often leading to full Linux host compromise.

Affected OFBiz

• Apache OFBiz before 18.12.15
• OFBiz exposed on ports 8443/8080 without reverse-proxy auth
• Legacy ERP stacks on Ubuntu, RHEL, and Docker images

Find OFBiz on your network

nmap -p 8080,8443 --script http-title 10.0.0.0/24
curl -sk https://target:8443/webtools/control/main | head -5

Fix

• Upgrade to OFBiz 18.12.15 or later immediately
• Block public access; require VPN or IP allowlist for /webtools
• Run OFBiz as unprivileged user; separate DB credentials from app user
• Scan for new JSP shells under runtime/ and unexpected cron jobs

CISA KEV listed. Mass scanning for /webtools/control/ is active.