Apache OFBiz - Information Disclosure (CVE-2024-38856)

CVE-2024-38856 is an Incorrect Authorization vulnerability in Apache OFBiz that can allow unauthenticated users to execute screen rendering code under certain conditions if endpoint permissions are not properly configured.

CrowdSec has been tracking this vulnerability and its exploits since 25th of October 2024.

CrowdSec network observations suggest that most exploitation of CVE-2024-38856 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2024-38856 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2024-38856 is currently experiencing high visibility and active exploitation across the internet.

Detection of exploitation attempts typically involves requests to unauthenticated endpoints in Apache OFBiz where permission enforcement has been misconfigured.