A critical code injection vulnerability in Apache OFBiz allows authenticated attackers to achieve remote code execution, posing a severe risk to system integrity.

This vulnerability consists of Improper Control of Generation of Code (CWE-94) and Improper Neutralization of Directives in Dynamically Evaluated Code (CWE-95), which allows an authenticated attacker to inject and execute arbitrary code through the application.

The CVSS score of 7.3 highlights the potential for full system compromise. Successful exploitation grants an attacker the ability to execute commands with the privileges of the OFBiz service, leading to total data exfiltration, service disruption, or the installation of persistent backdoors.

Immediate Action: Upgrade Apache OFBiz to version 24.09.06 or apply the upstream fix commit 25b27902c88c72633d57af66aa28b21ebf95cfc8.

Proactive Monitoring: Audit server logs for unauthorized code execution patterns or unexpected child processes spawned by the Java application process.

Compensating Controls: Ensure the application runs with the principle of least privilege, restricting the service account's ability to execute shell commands or write to sensitive directories.

Public Exploit Available: Unknown

Given the critical nature of code injection flaws, organizations should treat this update with high priority. Apply the vendor-provided patch to version 24.09.06 immediately to mitigate the risk of remote code execution.