Recent research has uncovered multiple vulnerabilities in enterprise Java platforms, notably affecting Bonita BPM and Apache OFBiz. These flaws could allow attackers to execute remote code without prior authentication, posing significant security risks to organizations relying on these platforms.
Bonita BPM Vulnerabilities
Bonita BPM version 10.4.3 contains several minor defects that, when combined, can bypass authentication mechanisms. The platform’s public API mandates session authentication and Cross-Site Request Forgery (CSRF) protection. However, its internal server API processes XStream XML and supports authentication. Researchers identified a path with encoded semicolons that different components interpreted inconsistently. This discrepancy allowed unauthenticated requests to reach XStream deserialization, potentially leading to remote code execution.
Apache OFBiz Vulnerabilities
Apache OFBiz version 24.09.05, an enterprise resource planning platform, also exhibits critical vulnerabilities. The platform utilizes Single Sign-On (SSO) tokens, widget rendering, Groovy, and FreeMarker templates. A default signing key included in the configuration validates HMAC-SHA-512 JSON Web Tokens (JWTs). If administrators haven’t replaced this key, attackers can forge JWTs to impersonate administrators. This forged identity can manipulate user preferences, such as enabling JavaScript, and inject Groovy expressions into claims. The widget engine processes these claims, leading to potential code execution. The platform’s defense mechanism, a case-sensitive denylist, fails to block malicious expressions due to Groovy’s flexible syntax, allowing attackers to bypass security measures.
These vulnerabilities underscore the importance of robust security practices in enterprise Java platforms. Organizations should promptly apply updates, review exposed services, and avoid unauthorized testing of systems. Internal middleware should be treated as exposed to mitigate potential threats.
To enhance security, teams should replace shared signing keys, separate keys across trust domains, and rotate secrets regularly. Removing template evaluation and deserialization where possible can reduce exposure. If serialization is necessary, implementing strict allowlists and Java Enhancement Proposal (JEP) 290 filters can mitigate risks. User preferences and settings should never authorize server-side evaluation to prevent exploitation.
These findings highlight the interconnected nature of routing decisions, identity tokens, and internal execution services as a unified attack surface. Comprehensive testing of their interactions is essential to fortify defenses against such vulnerabilities.
In light of these discoveries, organizations must reassess their security protocols and ensure that all components of their enterprise Java platforms are scrutinized for potential weaknesses. Proactive measures, including regular updates and thorough security audits, are crucial in safeguarding against emerging threats in the ever-evolving cybersecurity landscape.
