Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in Apache OFBiz, an enterprise resource planning system, could allow an attacker to access sensitive data. The issue lies in how the system handles certain data requests, potentially enabling unauthorized disclosure of information within the queried entity. While the default configurations for Derby and PostgreSQL are not affected, MySQL and MariaDB deployments are susceptible.
- Unauthenticated attackers may expose company data.
- Critical data access risk to ERP systems.
- Confirm OFBiz usage and exposure for MySQL/MariaDB.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this vulnerability by sending a specially crafted find request to the entity engine's generic performFind service. This crafted request, when processed by the `SqlJdbcUtil.addValueSingle` method, will directly embed a malicious value into the SQL query instead of using a secure parameter. On MySQL and MariaDB databases, this allows the attacker to break out of the intended string literal, modify the WHERE clause, and potentially retrieve any data from the database.
- Attacker can access the application remotely.
- Submitting a crafted ignore-case find request.
- Arbitrary row disclosure and potential data compromise.
Live Threat
Current exploitation, exposure, and threat context
When supported by the advisory, this SQL injection vulnerability in Apache OFBiz's entity engine could allow an unauthenticated remote attacker to disclose arbitrary rows from queried entities on MySQL/MariaDB-backed deployments. This occurs when a crafted ignore-case find request causes improperly escaped user input to break out of SQL string literals, effectively altering the WHERE clause.
- Arbitrary entity data could be disclosed.
- Unauthenticated remote network access.
- Sensitive data exposure and integrity loss.
Operational Fix
Recommended remediation, mitigation, and detection steps
In real-world scenarios, Apache OFBiz deployments are often managed by a combination of application owners, infrastructure teams, and potentially vendor-management if it's a third-party-hosted solution. The initial action should be to identify all instances of the affected OFBiz version, determine their internet-facing exposure and business criticality, and then locate the accountable teams responsible for each instance to prioritize remediation efforts.
- Application and platform teams own the issue.
- Verify internet exposure and business criticality.
- Plan targeted upgrades or vendor coordination.
