Apache OFBiz Authentication Bypass via Key Replay

An authentication bypass vulnerability has been found in Apache OFBiz 24.09 before 24.09.08. The flaw is a capture-replay authentication bypass in the ExternalLoginKeysManager.

An unauthenticated remote attacker who captures a live externalLoginKey value can obtain a complete, cookie-free, reusable session as the user who issued it, across every webapp that user can reach. The checkExternalLoginKey runs as a global preprocessor ahead of CSRF and authentication checks, accepting the key as a bearer credential that is never bound to a client, never expires, and is not invalidated after use.

The framework appends live keys to every cross-webapp link it renders, and via WidgetWorker's unvalidated inter-app link target, an authenticated user's key can be attached to an attacker-chosen absolute URL and delivered to the attacker's server.

• Affected versions: Apache OFBiz 24.09 before 24.09.08
• Impact: Remote unauthenticated session hijacking
• Fix: Upgrade to version 24.09.08