Authorization Bypass in Apache OFBiz Order Returns

Executive Summary

This vulnerability is an authorization bypass in Apache OFBiz 24.09 before 24.09.08. It allows a low-privileged authenticated user with Order Manager access to manipulate return items by associating another party's OrderItem with a ReturnItem they control through the createReturnItem service.

Useful 0 Not Useful 0

Detection Guidance

Check Apache OFBiz version with: grep -r '"version"' /path/to/ofbiz/release/notes/ | grep 24.09. If version is below 24.09.08, the system is vulnerable. Review logs for createReturnItem service calls by low-privileged users associating OrderItems with ReturnItems.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to improperly process returns, potentially leading to financial loss, fraudulent transactions, or unauthorized access to sensitive order data. Systems with OFBiz 24.09 before 24.09.08 are vulnerable.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated user with low-privileged access to manipulate order returns, potentially associating another party's OrderItem with a ReturnItem they control. This could lead to unauthorized access or modification of sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy).

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Apache OFBiz to version 24.09.08 or later immediately. If upgrading is not possible, restrict access to the createReturnItem service for low-privileged users by modifying service permissions in the application configuration.

Useful 0 Not Useful 0