Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issued it, in every webapp that user can reach, because checkExternalLoginKey runs as a global preprocessor ahead of both the CSRF and authentication checks and accepts the key as a bearer credential that is never bound to a client, never expires, and is not invalidated after use, while the framework itself both appends live keys to every cross-webapp link it renders and, via WidgetWorker's unvalidated inter-app link target, lets an authenticated user's key be attached to an attacker-chosen absolute URL and delivered directly to the attacker's own server. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz Üretici bülteni

Kayıt geçmişi

1. 5 Kas 2026 19:30CVSS puanı değişti: – → 9.8
2. 5 Kas 2026 17:04Yayımlandı

İlgili açıklar

• 4,3 CVE-2026-82902Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile
• 7,5 CVE-2026-82904Apache OFBiz'te parametre adına bağlı sınırsız çoklu form satır sayısı hatası
• 8,8 CVE-2026-82910Apache OFBiz: renderLink compiles link parameters as FreeMarker source
• 8,8 CVE-2026-82912Apache OFBiz: Unsandboxed Groovy compiled from a service parameter
• 7,1 CVE-2026-82916Apache OFBiz: webtools xmldsdump exports any entity to any path
• 8,8 CVE-2026-82960Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE