CVE-2025-61623: Apache OFBiz XSS Vulnerability

CVE-2025-61623 Overview

CVE-2025-61623 is a reflected cross-site scripting (XSS) vulnerability in Apache OFBiz, an open-source enterprise resource planning (ERP) suite. The flaw affects all Apache OFBiz releases prior to 24.09.03. Attackers can craft malicious URLs that, when visited by an authenticated or unauthenticated user, execute arbitrary JavaScript in the victim's browser session. The vulnerability is categorized under CWE-79, Improper Neutralization of Input During Web Page Generation. The Apache OFBiz project has released version 24.09.03 to remediate the issue.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in a victim's browser, enabling session hijacking, credential theft, and unauthorized actions within the OFBiz application context.

Affected Products

Apache OFBiz versions prior to 24.09.03
Apache OFBiz ERP suite deployments exposed to network-reachable users
Web-facing OFBiz instances handling user-supplied request parameters

Discovery Timeline

2025-11-12 - CVE-2025-61623 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61623

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the Apache OFBiz web interface. Reflected XSS occurs when user-supplied input is echoed back in an HTTP response without proper output encoding or input sanitization. An attacker crafts a URL containing malicious JavaScript payloads in a request parameter. When a victim clicks the link, the OFBiz server reflects the payload into the rendered HTML page, and the browser executes it in the trusted origin of the OFBiz application.

Because the attack vector is network-based and requires no privileges, any internet-reachable OFBiz deployment is exposed. The scope is unchanged, meaning the impact is limited to the OFBiz application context, but that context often includes sensitive ERP data such as financial records, customer information, and administrative controls.

Root Cause

The root cause is improper neutralization of untrusted input embedded in server-generated HTML responses. Apache OFBiz did not consistently apply contextual output encoding to reflected request parameters, allowing HTML and JavaScript metacharacters to pass through to the client. The fix in 24.09.03 addresses the specific reflection point identified in issue OFBIZ-13295.

Attack Vector

An attacker delivers a crafted URL to a target user through phishing, forum posts, or third-party sites. When the victim loads the URL against a vulnerable OFBiz instance, the malicious script executes with the privileges of the victim's session. Attackers can steal session cookies, submit unauthorized transactions, alter data displayed in the browser, or pivot to further attacks against the OFBiz backend.

No code example is published for this issue. Refer to the Apache OFBiz Issue OFBIZ-13295 and the Openwall OSS Security Discussion for additional technical context.

Detection Methods for CVE-2025-61623

Indicators of Compromise

HTTP request logs containing <script>, javascript:, onerror=, or URL-encoded equivalents (%3Cscript%3E) in query parameters targeting OFBiz endpoints.
Unexpected outbound requests from user browsers to attacker-controlled domains shortly after visiting OFBiz URLs.
Anomalous session activity such as unauthorized transactions or configuration changes tied to legitimate user accounts.

Detection Strategies

Inspect web server and reverse proxy access logs for OFBiz request parameters containing HTML or JavaScript metacharacters.
Deploy web application firewall (WAF) rules that flag reflected XSS signatures against OFBiz URI patterns.
Correlate suspicious URL patterns with user click-through events from email or messaging platforms.

Monitoring Recommendations

Enable and centralize logging for all Apache OFBiz HTTP request parameters, referrers, and response codes.
Monitor authentication and privileged action audit logs within OFBiz for actions that follow suspicious page loads.
Alert on repeated malformed or encoded parameter values targeting the same OFBiz endpoint across multiple sessions.

How to Mitigate CVE-2025-61623

Immediate Actions Required

Upgrade all Apache OFBiz deployments to version 24.09.03 or later as published in the Release Notes 24.09.03.
Restrict network exposure of OFBiz administrative and user-facing endpoints to trusted networks or VPN users where feasible.
Review recent web server logs for suspicious parameter payloads that may indicate exploitation attempts.

Patch Information

Apache has released Apache OFBiz 24.09.03, which fixes CVE-2025-61623. The patch and release details are documented in the Apache OFBiz Security Overview and the Apache Mailing List Thread. Download the updated release from the Apache OFBiz Downloads page.

Workarounds

Deploy a WAF rule set that blocks common XSS payloads (<script>, onerror=, javascript:) targeting OFBiz request parameters until patching is complete.
Enforce a strict Content Security Policy (CSP) header on OFBiz responses to limit inline script execution and restrict script sources.
Set HttpOnly and Secure flags on OFBiz session cookies to reduce the impact of session token theft via JavaScript.

bash

# Example nginx reverse proxy hardening in front of Apache OFBiz
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;