# CVE-2024-32113: Apache OFBiz RCE Exploited for Mirai Botnet

> Technical analysis of CVE-2024-32113 exploitation in Apache OFBiz. Learn how attackers use path traversal to deploy Mirai botnet malware and how to patch.

- Published: 2026-04-06T05:02:01.000Z
- Severity: high
- Category: Vulnerabilities
- Tags: CVE-2024-32113, Apache OFBiz, Mirai, RCE, Path Traversal
- Author: Runtime Rebel Intel
- Primary source: https://isc.sans.edu/diary/rss/32868
- Canonical: https://runtimerebel.com/blog/cve-2024-32113-apache-ofbiz-rce-exploited-for-mirai-botnet

## Key points

- Immediate impact: Unauthenticated attackers are gaining full system control and recruiting vulnerable servers into automated botnets.
- Affected systems: All Apache OFBiz installations running versions prior to 18.12.13 are susceptible to this path traversal flaw.
- Remediation: Organizations must update to Apache OFBiz 18.12.13 immediately to prevent automated exploitation and malware persistence.

Recent threat intelligence confirms that attackers are actively targeting a critical [CVE](/glossary#cve) in Apache Open For Business (OFBiz), an open-source Enterprise Resource Planning (ERP) suite. According to [SANS Internet Storm Center](https://isc.sans.edu/diary/32868), exploitation of [CVE-2024-32113](/cve/cve-2024-32113) has transitioned from theoretical proof-of-concept to active deployment of the Mirai malware family. This vulnerability, which carries a [CVSS](/glossary#cvss) score of 9.8, represents a significant risk to organizations relying on unpatched ERP infrastructure.

## Technical Analysis: Mirai botnet Apache OFBiz exploitation

The vulnerability is rooted in a path traversal flaw within the web interface of Apache OFBiz. Specifically, the software failed to properly sanitize URI inputs, allowing attackers to manipulate request paths to bypass internal security filters. The primary [TTP](/glossary#ttp) observed involves sending a crafted HTTP request to the `/control/forgetPassword` endpoint. By appending semicolon-delimited segments or specific traversal sequences, attackers can force the application to execute arbitrary code with the privileges of the OFBiz process.

Once the [RCE](/glossary#rce) is achieved, the automated exploitation scripts typically attempt to download and execute a shell script. These scripts are designed to fetch various Mirai binaries compiled for different CPU architectures (e.g., ARM, MIPS, x86). This activity effectively recruits the compromised server into a botnet, which is then used for launching [DDoS](/glossary#ddos) attacks or further network scanning. Because ERP systems often have significant outbound bandwidth and are rarely rebooted, they are ideal candidates for maintaining botnet persistence.

### How to detect CVE-2024-32113 exploit attempts

Defenders can identify exploitation attempts by monitoring web server access logs for unusual URI patterns. Security teams should prioritize searching for requests containing `/control/forgetPassword;` or similar variations where non-standard characters are used to obfuscate the path. Furthermore, the presence of outbound connections to known malicious IP addresses on ports commonly associated with malware delivery—such as 80, 443, or 8080—should be investigated.

Automating the detection process by ingesting these logs into a [SIEM](/glossary#siem) allows for real-time alerting. An effective [IoC](/glossary#ioc) strategy involves correlating these web requests with subsequent suspicious process execution, such as `wget` or `curl` commands fetching binary files from remote repositories. A modern [EDR](/glossary#edr) solution should also flag the spawning of a system shell from the Java-based OFBiz process, as this is a high-confidence indicator of compromise.

## Apache OFBiz 18.12.13 patch guidance

The most effective mitigation is the immediate application of the official security update. Apache released version 18.12.13 specifically to address this path traversal issue. Organizations should verify their current versioning and prioritize the update on all internet-facing instances. If an immediate update is not feasible, the [SOC](/glossary#soc) should implement strict ingress filtering. Blocking access to the `/control/` directory from external IP addresses, or specifically restricting access to the `forgetPassword` functionality, can provide temporary protection.

In addition to patching, security administrators should audit their systems for existing signs of compromise. Check for the existence of unexpected files in `/tmp` or `/var/run` and review active network connections for persistence mechanisms. Given that the vulnerability allows for unauthenticated code execution, assuming a breach has occurred on any unpatched, internet-exposed system is a prudent defensive posture.

**Related:** [CVE-2024-50498: Wing FTP Server Exploited in RCE Chains — Patch Now](/blog/cve-2024-50498-wing-ftp-server-exploited-in-rce-chains-patch-now), [CVE-2021-35587: Critical RCE in Oracle Identity Manager Patched](/blog/cve-2021-35587-critical-rce-in-oracle-identity-manager-patched)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cve-2024-32113-apache-ofbiz-rce-exploited-for-mirai-botnet