New 0day RCE in Apache OFBiz (CVE-2023-51467): Patch Now

> About Author

Hi, I'm Sharon, a product manager at Chaitin Tech. We build SafeLine, an open-source Web Application Firewall built for real-world threats. While SafeLine focuses on HTTP-layer protection, our emergency response center monitors and responds to RCE and authentication vulnerabilities across the stack to help developers stay safe.

A critical unauthenticated RCE vulnerability affects all OFBiz versions before 18.12.11

What is Apache OFBiz?

Apache OFBiz is a popular open-source enterprise resource planning (ERP) system, offering a wide range of business functions and modules — from inventory to accounting and HR.

But in December 2023, security researchers at Chaitin Tech discovered a critical unauthenticated Remote Code Execution (RCE) vulnerability in OFBiz, now tracked as CVE-2023-51467. The flaw has no prerequisites, is easy to exploit, and impacts a wide range of deployments.

Vulnerability Overview (CVE-2023-51467)

Root Cause

The vulnerability exists due to flaws in OFBiz’s authentication logic, allowing attackers to bypass login controls and directly access backend components. Combined with insecure handling of user input in some endpoints, this flaw enables arbitrary code execution on the server.

Impact

• 
  Full server compromise via remote code execution


• 
  No login required to exploit


• Sensitive data leakage


• Business disruption

Affected Versions

Apache OFBiz < 18.12.11

All installations running versions prior to 18.12.11 are vulnerable and should upgrade immediately.

How to Fix It

Permanent Fix

Upgrade to the latest version available from the official download page.

# Example: download and deploy OFBiz 18.12.11 or newer

Temporary Mitigations

If you can’t patch right away:

• 
  Restrict Access: Only allow access to the OFBiz interface from trusted internal networks.


• 
  Enable Audit Logging: Monitor for unusual login attempts or suspicious input patterns.


• 
  Deploy WAF Rules: Use custom rules to block suspicious patterns known to exploit this vulnerability.

Vulnerability Reproduction

Chaitin researchers successfully reproduced the exploit on the official OFBiz demo instance (now patched). Below are screenshots of local and remote exploitation.

This RCE requires no authentication, making it highly exploitable in real-world environments.

Detection & Product Support

The following security products support detection of this vulnerability:

• 
  Yuntu: Supports OFBiz fingerprinting and PoC-level detection


• 
  DongJian: Allows customized PoC detection for CVE-2023-51467


• 
  MuYun (Chaitin’s Cloud Platform):
  
  
  
  
  • Version 23.05.001+ supports detection via emergency vulnerability package EMERVULN-23.12.027
    
  
  
  • Older versions: contact MuYun technical support
  
  
  
  
  
  

Timeline

• 
  Dec 2023 – Vulnerability reported to Apache by Chaitin Tech
  


• 
  Dec 2023 – Official patch released
  


• 
  Dec 2023 – Chaitin Emergency Response Center releases public advisory
  

Final Thoughts

CVE-2023-51467 is a high-risk, unauthenticated RCE vulnerability in a widely deployed open-source ERP system. Attackers can exploit it with zero credentials and minimal effort.

If you're running OFBiz and haven’t patched yet — now is the time.

Join the SafeLine Community

If you continue to experience issues, feel free to contact SafeLine support for further assistance.

• 
  GitHub Repository
  


• 
  Official Docs
  


• Discord Community