An unauthenticated SSRF vulnerability in Apache OFBiz allows remote attackers to perform unauthorized requests, potentially leading to internal network reconnaissance.

This is a Server-Side Request Forgery (CWE-918) vulnerability occurring in Apache OFBiz. The flaw allows an unauthenticated, remote attacker to influence the server's request-making capabilities, as indicated by the CVSS vector AV:N/AC:L/PR:N.

Successful exploitation allows an attacker to bypass perimeter security to access internal network resources, query sensitive APIs, or perform port scanning of internal infrastructure. While the CVSS score is 7.5, the potential for internal network compromise makes this a significant risk for organizations hosting OFBiz in sensitive environments.

Immediate Action: Upgrade to Apache OFBiz version 24.09.06 or later immediately.

Proactive Monitoring: Monitor network traffic originating from the OFBiz server for unexpected connections to internal services or non-standard external endpoints.

Compensating Controls: If patching is delayed, implement strict egress filtering on the application server to prevent connections to unauthorized internal or external destinations.

Public Exploit Available: Unknown.

The vulnerability poses a moderate-to-high risk to organizational infrastructure due to the potential for internal network exposure. Administrators should prioritize updating to version 24.09.06 to resolve the underlying SSRF flaw and prevent potential unauthorized internal reconnaissance.