CVE-2024-14046: OpenBoxes Unrestricted Upload Vulnerability

CVE-2024-14046 Overview

CVE-2024-14046 is an unrestricted file upload vulnerability in OpenBoxes up to version 0.9.1. The flaw resides in the DocumentController class located at grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy, part of the Document Upload Controller component. Authenticated remote attackers can manipulate document upload requests to bypass file type restrictions. The issue is tracked under CWE-284: Improper Access Control. OpenBoxes released version 0.9.2 to remediate the vulnerability, with the fix committed as e945d6bfcec29642f514e7d298dfba2cc6cd7cd4. Public disclosure of the exploit details has occurred through VulDB entry 391110.

Critical Impact
Authenticated remote attackers can upload arbitrary document types to OpenBoxes instances running versions up to 0.9.1, potentially leading to unauthorized content placement within the warehouse management system.

Affected Products

OpenBoxes versions up to and including 0.9.1
DocumentController.groovy in the Document Upload Controller component
OpenBoxes warehouse management platform prior to release v0.9.2

Discovery Timeline

2026-08-18 - CVE-2024-14046 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2024-14046

Vulnerability Analysis

The vulnerability affects the file upload handler within DocumentController.groovy. OpenBoxes accepts document uploads without adequately restricting file types to those associated with authorized template document codes. An authenticated user with low privileges can submit upload requests containing document types outside the permitted set. Exploitation is possible remotely over the network and does not require user interaction. The pull request #4764 that resolves the issue is titled "OBPIH-6577 Prevent only document types with template document codes to be upload," clarifying that the pre-patch controller did not enforce this restriction.

Root Cause

The root cause is improper access control [CWE-284] within the document upload flow. The controller relied on client-supplied parameters to determine acceptable upload types rather than validating uploads against a server-enforced allowlist tied to template document codes. This missing authorization check permits any authenticated user to submit unrestricted document uploads.

Attack Vector

An attacker requires network access to the OpenBoxes application and valid low-privilege credentials. The attacker then sends a crafted upload request to the Document Upload Controller endpoint. Because the controller does not validate document types against the template document codes, the upload succeeds regardless of the intended restriction. Proof-of-concept details are referenced in a public GitHub Gist.

text

     def shipmentService
     GrailsApplication grailsApplication
     TemplateService templateService
-    DocumentService documentService
     StockMovementService stockMovementService
     OutboundStockMovementService outboundStockMovementService

Source: OpenBoxes commit e945d6b. The patch refactors DocumentController.groovy to remove the unrestricted documentService dependency and enforce that only document types associated with template document codes are accepted.

Detection Methods for CVE-2024-14046

Indicators of Compromise

Unexpected files stored under the OpenBoxes document repository that do not correspond to defined template document codes.
Application logs showing successful uploads through DocumentController from low-privilege user accounts with atypical file extensions or MIME types.
HTTP POST requests to document upload endpoints containing document type parameters that do not match approved template document codes.

Detection Strategies

Review OpenBoxes application logs for DocumentController upload events and correlate uploaded file types against the configured template document codes.
Audit the document storage directory for files uploaded prior to upgrading to version 0.9.2, comparing extensions and content against expected inventory documentation.
Instrument web application firewall (WAF) rules to flag POST requests to OpenBoxes document upload endpoints containing non-standard file extensions.

Monitoring Recommendations

Enable verbose logging for authentication events and controller actions within the Grails application to capture upload attempts.
Forward OpenBoxes application and web server logs to a centralized logging platform for retention and search.
Monitor filesystem changes in the OpenBoxes document upload directory using integrity monitoring tools.

How to Mitigate CVE-2024-14046

Immediate Actions Required

Upgrade OpenBoxes to version 0.9.2 or later, which includes the fix from commit e945d6bfcec29642f514e7d298dfba2cc6cd7cd4.
Audit existing document uploads for files that do not match approved template document codes and quarantine suspicious artifacts.
Restrict access to the OpenBoxes application to trusted users and networks until the upgrade is completed.

Patch Information

The OpenBoxes project addressed CVE-2024-14046 in release v0.9.2. The corresponding source change is available in commit e945d6b and merged through pull request #4764. Administrators should follow the standard OpenBoxes upgrade procedure documented in the OpenBoxes GitHub repository.

Workarounds

Limit OpenBoxes account creation and reduce the number of users with upload privileges until the patch is applied.
Place the OpenBoxes application behind a reverse proxy or WAF that enforces file extension and MIME type allowlists on document upload endpoints.
Regularly review the document storage directory and remove any files that were not created through legitimate template-driven workflows.

bash

# Example: verify the deployed OpenBoxes version corresponds to the patched release
git -C /opt/openboxes describe --tags
# Expected output: v0.9.2 or later