{"id":"CVE-2026-84183","published":"2026-11-05T14:17:06.953","lastModified":"2026-11-06T05:18:37.307","description":"Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW to execute arbitrary commands as the OFBiz process user, by using updateLayout's authorization check — which validates only the fixed CONTENT_CREATE operation rather than an update permission on the actual Content record and an independently selected DataResource — to relink an existing RESPONSE-purpose Content record and convert an arbitrary, independently selected DataResource into an OFBIZ_FILE/FTL resource pointed at the OFBiz access log, poisoned via a crafted User-Agent header and evaluated through the normal authenticated showContent route. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A misconfigured authorization check in Apache OFBiz's updateLayout method allows an authenticated attacker with low-privilege roles (OFBTOOLS_VIEW and CONTENTMGR_VIEW) to relink arbitrary data resources as FreeMarker templates, enabling remote code execution via crafted User-Agent headers logged into the access log.","exploitability":"Exploitation requires a valid OFBiz account with only OFBTOOLS_VIEW and CONTENTMGR_VIEW permissions; no additional privileges or external access are needed.","blast_radius":"Successful exploitation grants the attacker full control over the OFBiz process user, enabling full system compromise including data theft, service disruption, and lateral movement.","remediation":"Upgrade to Apache OFBiz version 24.09.08 immediately, which contains the official fix for this issue.","detection":"Monitor access logs for entries containing User-Agent strings with FreeMarker syntax (e.g., ${...}) or suspicious template directives, followed by subsequent HTTP requests that trigger rendering of the affected content via showContent; also watch for unexpected changes to Content records linking RESPONSE-type content to OFBIZ_FILE/FTL data resources.","tags":["rce","auth-bypass","web","template-injection","ofbiz"],"model":"garnet-coder","analyzedAt":"2026-11-06T09:53:15.330Z"}}