Recent research unveiled at Black Hat 2026 has brought to light significant vulnerabilities in enterprise Java platforms. Researchers identified 12 flaws that could enable attackers to execute remote code, emphasizing the critical nature of these findings. Key targets of these vulnerabilities include Bonita BPM and Apache OFBiz, both of which are susceptible to remote code execution due to complex interactions within their systems.
Remote Code Execution Chains Identified
The study highlights two primary remote code execution chains affecting Bonita BPM and Apache OFBiz. These chains allow unauthorized access before authentication, leveraging interactions between routing, authentication processes, and execution features. Such vulnerabilities pose severe security threats, necessitating immediate attention from administrators.
In response, researchers ensured that all issues were responsibly disclosed to affected vendors before public release. They advise administrators to promptly apply security updates, scrutinize exposed services, and avoid unauthorized testing of systems. Recognizing internal middleware as potentially exposed can enhance security measures.
Technical Insights into the Vulnerabilities
Bonita BPM version 10.4.3 serves as an example of how minor flaws can compromise authentication barriers. The public API requires session and CSRF protection, whereas the internal server API processes XStream XML. Researchers discovered a path with encoded semicolons causing different component interpretations.
Apache OFBiz version 24.09.05 exhibits similar vulnerabilities. This platform supports SSO tokens and uses a denylist approach for expression inspection, which proved unreliable due to case sensitivity and alternative class naming.
Recommendations for Mitigating Risks
Security experts stress the importance of validating signed data by purpose, type, and content rather than signature alone. They advise checking for chained weaknesses and ensuring security constraints guard against different types of request paths. Authentication and CSRF filters should match normalized paths instead of accepting partial matches.
Organizations should replace shared signing keys and rotate secrets regularly. Removing template evaluation and deserialization can mitigate risks, while strict allowlists and JEP 290 filters can offer additional protections. Avoiding server-side evaluation based on user preferences is crucial to safeguarding systems.
Overall, the findings underscore that routing decisions, identity tokens, and internal execution services create a unified attack surface. Protecting this surface requires thorough testing of their interactions and enhancing security protocols accordingly.
