Server‑Side Request Forgery exists in the viewdatafile screen of Apache OFBiz 24.09 before 24.09.08. A remote attacker authenticated with only basic webtools permissions can cause the application to perform arbitrary outbound HTTP requests, and an attacker with ENTITY_MAINT and DATAFILE_MAINT permissions can read arbitrary files on the server through a file: URL. This allows sensitive data exposure and potential reconnaissance of the network through outbound traffic, but no remote code execution is described in the advisory.

The vulnerability affects Apache OFBiz version 24.09, all platforms, before the 24.09.08 release. Users of the on‑premises distribution should confirm their version and upgrade path.

The exploit requires legitimate credentials with webtools permissions; no public exploit is reported and EPSS data is unavailable. The lack of a KEV listing suggests no widespread exploitation has been observed yet, yet the high impact of a file‑read SSRF warrants a high alert. Adversaries would need to authenticate to the application, then supply crafted DEFINITION_LOCATION or DATAFILE_LOCATION parameters to trigger the vulnerable code before the framework applies its normal permission checks.