CVE-2026-82902: Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile
Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions (OFBTOOLSVIEW, WEBTOOLSVIEW) to cause the server to issue arbitrary outbound HTTP requests, and an attacker additionally holding ENTITYMAINT and DATAFILEMAINT to read arbitrary local files via a file: URL, by supplying the DEFINITIONLOCATION or DATAFILELOCATION request parameter to the viewdatafile screen, because ViewDataFile.groovy dereferences both parameters as java.net.URL objects with no scheme allow-list, host filter, or egress control inside a screen action that runs before the screen's and template's permission checks are evaluated, so the fetch executes regardless of whether the requesting account is authorized to view its result. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache OFBizto a version that resolves this vulnerability.Fixed in 24.09.08
Event History
Frequently Asked Questions
Which accounts can trigger the outbound requests?
Any remote authenticated account with the base webtools permissions OFBTOOLS_VIEW and WEBTOOLS_VIEW can cause arbitrary outbound HTTP requests. The request is performed before the screen and template permission checks, so authorization to view the resulting content does not prevent the fetch.
When can this be used to read local files?
Local-file reads through a file: URL require the additional ENTITY_MAINT and DATAFILE_MAINT permissions. The affected parameters are DEFINITION_LOCATION and DATAFILE_LOCATION.
Are default deployments affected?
The provided information identifies Apache OFBiz 24.09 releases before 24.09.08 on all platforms, but does not state which permissions are assigned by default. Exposure depends on whether an attacker can authenticate with the listed webtools permissions.
What should be done if remediation is not immediate?
Restrict access to accounts holding OFBTOOLS_VIEW and WEBTOOLS_VIEW, and remove or tightly limit ENTITY_MAINT and DATAFILE_MAINT where they are not required. Network egress controls can also reduce the impact of arbitrary outbound HTTP requests.
How can administrators determine whether they are affected?
Check whether the deployment is running Apache OFBiz 24.09 before 24.09.08 and whether untrusted users have the listed webtools permissions. Review requests to the viewdatafile screen for DEFINITION_LOCATION or DATAFILE_LOCATION values, especially URLs targeting internal services or file: locations.