Missing Authorization Check in Apache OFBiz

Executive Summary

This vulnerability is a missing authorization check in Apache OFBiz versions through 24.09.07. It allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data by exploiting a crafted partyId parameter in the getHRChild service. This includes department names, employee identifiers, position details, and organization relationships.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending crafted requests to the getHRChild service endpoint in Apache OFBiz. Use tools like curl to query the service with a partyId parameter and check for unauthorized access to HR data. Example command: curl -v 'http://<target>/webtools/control/getHRChild?partyId=10000'

Useful 0 Not Useful 0

Impact Analysis

An attacker could access sensitive HR data, including employee identifiers, department structures, and organizational relationships. This could lead to privacy breaches, data leaks, or targeted attacks against employees. The vulnerability does not require authentication, increasing the risk of exploitation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal and sensitive employee data. GDPR requires strict access controls for personal data, while HIPAA mandates protection of health-related information. Exploitation could result in non-compliance penalties and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Apache OFBiz to version 24.09.08 or later to fix the missing authorization check. If upgrading is not immediately possible, restrict access to the getHRChild service endpoint via network controls or disable the service if not required.

Useful 0 Not Useful 0