CVE-2025-30676: Apache OFBiz XSS Vulnerability

CVE-2025-30676 Overview

CVE-2025-30676 is a Basic Cross-Site Scripting (XSS) vulnerability in Apache OFBiz, the open-source enterprise resource planning (ERP) framework. The flaw stems from improper neutralization of script-related HTML tags in a web page ([CWE-80], [CWE-79]). All Apache OFBiz releases before 18.12.19 are affected. An unauthenticated attacker can craft a malicious link that, when clicked by a target user, executes arbitrary JavaScript in the victim's browser session against the OFBiz application.

Critical Impact
Successful exploitation allows attackers to hijack authenticated OFBiz sessions, steal cookies, perform actions on behalf of ERP users, or deliver secondary payloads to internal staff and customers.

Affected Products

Apache OFBiz versions prior to 18.12.19
Apache OFBiz deployments exposing web-facing components (webtools, ecommerce, accounting)
Any downstream product bundling vulnerable Apache OFBiz releases

Discovery Timeline

2025-04-01 - CVE-2025-30676 published to NVD following coordinated disclosure through the Apache Security process
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30676

Vulnerability Analysis

The vulnerability is a reflected Cross-Site Scripting flaw in Apache OFBiz web interfaces. User-controlled input reaches an HTML rendering path without sufficient neutralization of script-related tags. When a victim loads a crafted URL, the injected markup is reflected into the response and parsed as active content by the browser.

Exploitation requires user interaction, and the attack executes in the browser context of the targeted OFBiz user. Because the scope changes across a security boundary, injected script can reach cookies, form data, and other resources associated with the OFBiz application beyond the vulnerable component itself. The confidentiality and integrity impacts are limited to what the victim's session can access, but in ERP deployments this typically includes financial, inventory, and customer records.

The issue is tracked upstream as OFBIZ-13219 and disclosed publicly on the OSS-Security mailing list.

Root Cause

The root cause is missing or insufficient output encoding when reflecting request parameters into HTML responses. OFBiz did not consistently apply script-tag neutralization to the affected parameters, allowing <script> and equivalent HTML constructs to survive server-side processing and reach the DOM as executable content. [CWE-80] specifically covers the failure to neutralize script-related HTML tags.

Attack Vector

The attack is network-based and requires no authentication, but it does require the victim to interact with a crafted link or form. A typical exploitation chain proceeds as follows: an attacker builds a URL targeting the vulnerable OFBiz endpoint with a payload embedded in a parameter, distributes that URL via phishing, chat, or a malicious site, and waits for an authenticated OFBiz user to load it. The injected script then executes with the victim's OFBiz session privileges and can exfiltrate the session cookie, submit authenticated requests, or render a spoofed login form to harvest credentials.

No public proof-of-concept exploit is currently listed in Exploit-DB or CISA KEV, though the EPSS model indicates elevated real-world exploitation probability.

See the Apache OFBiz security overview for the vendor's technical description.

Detection Methods for CVE-2025-30676

Indicators of Compromise

HTTP requests to Apache OFBiz endpoints containing URL-encoded <script>, javascript:, onerror=, or onload= fragments in query parameters or form fields.
Reflected OFBiz responses that echo request parameters into HTML without HTML entity encoding.
Outbound browser requests from OFBiz users to unfamiliar domains immediately after clicking an OFBiz link (potential cookie exfiltration).
Anomalous session activity from OFBiz users, including actions performed from unexpected IP addresses using a valid session cookie.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag script-related HTML tags and JavaScript event handlers in requests to /webtools, /accounting, /ecommerce, and other OFBiz mount points.
Correlate web server access logs with referer headers to identify users arriving at OFBiz through external links carrying suspicious query strings.
Inspect Content Security Policy (CSP) violation reports if CSP is enabled on the OFBiz frontend.

Monitoring Recommendations

Monitor Apache OFBiz application logs for reflected input patterns and 200-OK responses containing user-supplied payloads.
Alert on new outbound connections initiated by browsers immediately after loading OFBiz pages.
Track the installed OFBiz version across environments and alert when any host reports a version earlier than 18.12.19.

How to Mitigate CVE-2025-30676

Immediate Actions Required

Upgrade Apache OFBiz to version 18.12.19 or later on all production, staging, and development instances.
Invalidate active OFBiz sessions and force re-authentication after patching to remove any sessions potentially hijacked prior to remediation.
Restrict network exposure of OFBiz management interfaces to trusted networks or VPN users until patching completes.
Review recent OFBiz access logs for requests containing script-tag payloads and investigate affected user accounts.

Patch Information

Apache has released Apache OFBiz 18.12.19, which addresses CVE-2025-30676 by adding proper neutralization of script-related HTML tags in the affected code paths. Download the fixed release from the Apache OFBiz download page and follow the standard upgrade procedure. The associated tracking ticket is OFBIZ-13219, and the announcement is available on the Apache mailing list.

Workarounds

Enforce a strict Content Security Policy on OFBiz responses to block inline script execution and restrict script sources to trusted origins.
Deploy WAF signatures that reject requests containing raw or URL-encoded <script>, <iframe>, and JavaScript event handler attributes against OFBiz URIs.
Configure the HttpOnly and Secure flags on OFBiz session cookies to reduce the impact of cookie theft.
Train OFBiz users to avoid clicking OFBiz links delivered from untrusted external sources until patching is complete.

bash

# Verify the installed Apache OFBiz version after upgrade
cd /opt/ofbiz
./gradlew --version
grep -R "release.version" ./ | head

# Example CSP header for the OFBiz reverse proxy (nginx)
add_header Content-Security-Policy \
  "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'" always;