CVE-2024-14045: OpenBoxes Auth Bypass Vulnerability

CVE-2024-14045 Overview

CVE-2024-14045 is an improper authorization vulnerability in OpenBoxes up to version 0.9.2. The flaw resides in grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy within the Product Supplier Edit Controller component. The interceptor fails to enforce required role checks on create, delete, and edit actions of the productSupplier controller. An authenticated remote attacker can invoke these actions without holding the appropriate administrative role. A public exploit is available, and the issue is fixed in OpenBoxes 0.9.3 via commit f767ac1a5987d4865d9f158c6a967680f8e45468. The weakness is categorized under [CWE-266] (Incorrect Privilege Assignment).

Critical Impact
Authenticated low-privilege users can invoke product supplier create, edit, and delete actions that should be restricted to administrators or product managers.

Affected Products

OpenBoxes versions up to and including 0.9.2
Component: RoleInterceptor.groovy (Product Supplier Edit Controller)
Fixed in OpenBoxes 0.9.3

Discovery Timeline

2026-08-18 - CVE-2024-14045 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2024-14045

Vulnerability Analysis

OpenBoxes uses a Grails interceptor pattern to enforce role-based access control on controller actions. The RoleInterceptor.groovy file defines maps of controllers and actions that require elevated privileges. Prior to version 0.9.3, the productSupplier controller was not listed in these maps for the create, delete, and edit actions. As a result, any authenticated user could invoke these actions regardless of their assigned role. The vulnerability allows unauthorized modification of product supplier records, undermining the integrity of supply chain data managed by the application.

Root Cause

The root cause is a missing access rule entry in the runtime configuration and interceptor logic. The productSupplier controller lacked an explicit binding to RoleType.ROLE_ADMIN with supplemental ROLE_PRODUCT_MANAGER privileges. Without this binding, the interceptor defaulted to permitting authenticated access, resulting in incorrect privilege assignment ([CWE-266]).

Attack Vector

An attacker with valid low-privilege credentials sends HTTP requests to the productSupplier controller endpoints for create, delete, or edit. Because RoleInterceptor.groovy does not enforce a minimum required role for these actions, the requests are processed successfully. The attack requires network access to the OpenBoxes instance and authenticated (but low-privilege) session context.

groovy

// Security patch in grails-app/conf/runtime.groovy
// Adds explicit access rule requiring ROLE_ADMIN with supplemental ROLE_PRODUCT_MANAGER
[controller: 'stockMovementApi', actions: ['delete'], accessRules: [ minimumRequiredRole: RoleType.ROLE_ASSISTANT]],
[controller: 'product', actions: ['merge'], accessRules: [ minimumRequiredRole: RoleType.ROLE_ADMIN]],
[controller: 'user', actions: ['changePassword'], accessRules: [ minimumRequiredRole: RoleType.ROLE_AUTHENTICATED]],
+ [controller: 'productSupplier', actions: ['create', 'delete'], accessRules: [ minimumRequiredRole: RoleType.ROLE_ADMIN], supplementalRoles: [RoleType.ROLE_PRODUCT_MANAGER]],

Source: OpenBoxes Commit f767ac1a

groovy

// Security patch in grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy
// Adds productSupplier to the map of controllers requiring elevated roles for create/delete/edit
'location'     : ['edit'],
'shipper'      : ['create'],
'locationGroup': ['create'],
- 'locationType' : ['create']
+ 'locationType' : ['create'],
+ 'productSupplier': ['create', 'delete', 'edit']

Source: OpenBoxes Commit f767ac1a

Detection Methods for CVE-2024-14045

Indicators of Compromise

HTTP requests to /productSupplier/create, /productSupplier/edit, or /productSupplier/delete originating from user sessions that do not hold ROLE_ADMIN or ROLE_PRODUCT_MANAGER.
Unexpected creation, modification, or deletion of product supplier records in the OpenBoxes audit log.
Application logs showing successful action dispatch on productSupplier endpoints without corresponding role authorization events.

Detection Strategies

Correlate web server access logs with OpenBoxes user role assignments to flag productSupplier action requests from non-privileged accounts.
Deploy application-layer rules on a reverse proxy or WAF to log and alert on productSuppliercreate, edit, and delete requests.
Review database change history for product_supplier table mutations that lack an approval trail.

Monitoring Recommendations

Enable verbose Grails interceptor logging in staging to baseline expected role checks and identify gaps.
Alert on any HTTP 200 response to productSupplier mutation endpoints made by sessions lacking administrative claims.
Monitor for anomalous supplier record volume changes over short time windows.

How to Mitigate CVE-2024-14045

Immediate Actions Required

Upgrade OpenBoxes to version 0.9.3 or later, which contains commit f767ac1a5987d4865d9f158c6a967680f8e45468.
Audit existing product supplier records for unauthorized additions, modifications, or deletions.
Review and revoke unnecessary authenticated accounts, particularly those with weak passwords.

Patch Information

The fix is applied in OpenBoxes 0.9.3 via pull request #4905 and commit f767ac1a5987d4865d9f158c6a967680f8e45468. The patch registers the productSupplier controller actions (create, delete, edit) in RoleInterceptor.groovy and runtime.groovy, requiring ROLE_ADMIN with supplemental ROLE_PRODUCT_MANAGER privileges. See the OpenBoxes Release v0.9.3 notes for full details.

Workarounds

Restrict network access to the OpenBoxes application to trusted operators until the upgrade is applied.
Add a reverse proxy or WAF rule that blocks requests to /productSupplier/create, /productSupplier/edit, and /productSupplier/delete from non-administrative user sessions.
Temporarily disable low-privilege accounts that are not required for daily operations.

bash

# Example NGINX rule to block productSupplier mutation endpoints pending patch
location ~ ^/openboxes/productSupplier/(create|edit|delete) {
    # Allow only trusted admin IPs
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://openboxes_backend;
}