# Pre-auth RCE chains in Bonita BPM 10.4.3 and Apache OFBiz 24.09.05 (CVE-2026-31986)

> Novee researchers demonstrated two pre-authentication remote code execution chains at Black Hat USA 2026: a path-traversal + XStream deserialization chain in Bonita BPM 10.4.3 bypassing the public API surface into the internal API, and a forged-SSO-token chain in Apache OFBiz 24.09.05 using publicly-shipped signing keys to reach Groovy evaluation. Both vendors released fixes within the standard 90-day disclosure timeline.

- **Published:** 2026-08-05T00:00:00Z
- **Last reviewed:** 2026-08-09T19:52:47.579Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1898
- **ID:** TL-2026-1898
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-31986, CVE-2022-25237, CVE-2026-45434, CVE-2026-46586

## Description

At Black Hat USA 2026 (August 5, 2026), Novee Security researchers Lidor Ben Shitrit and Assaf Levkovich presented two pre-authentication remote code execution chains targeting widely-deployed enterprise Java platforms: Bonita BPM (Bonitasoft) and Apache OFBiz. The talk, titled 'Pre-auth RCE in Enterprise Java: When Middleware Becomes the Exploit,' exposed how trusted enterprise middleware layers that were never designed to process untrusted input can become reliable RCE paths. Novee's broader research yielded 12 vulnerabilities across four enterprise Java platforms, including a sandbox escape, with these two chains representing the most impactful findings.

The Bonita BPM 10.4.3 chain exploits a parsing differential between Bonita's security filters and the underlying Apache Tomcat servlet container to collapse three independent security boundary checks via a single crafted URL. (1) Path traversal via the `..;` sequence: Bonita's security filter interprets the segment as a benign path component, while Tomcat strips the semicolon as a matrix parameter delimiter and treats the remainder as a directory traversal, routing the request to the internal API surface. (2) Substring-based filter matching: a fabricated application name embedded in the path satisfies both Bonita's authentication filter and CSRF token guard simultaneously, as both filters stop reading at the substring they matched. (3) Incomplete forward protection: one request type is protected against direct external access but forwarded requests bypass that protection entirely. The result is a single unauthenticated POST request that reaches Bonita's internal API endpoint, which feeds attacker-supplied XML directly into XStream deserialization. The XStream payload constructs a Commons Collections gadget chain that routes through a memory shortcut bypassing standard safety checks, culminating in a Groovy call that executes arbitrary OS commands. The entire sequence executes inside a single XStream call before the request finishes. These vulnerabilities were tracked internally by Bonitasoft as CVE-233 (path traversal/authentication bypass via semicolon parsing differential), CVE-234 (pre-authentication RCE via XStream deserialization), and CVE-235 (pre-authentication SSRF via ObjectInputStream deserialization). They were fixed in Bonita 2025.2-u5 (released February 26, 2026). Bonita version 10.4.3 maps to 2025.2-u3, which predates the fix and is therefore vulnerable.

The Apache OFBiz 24.09.05 chain (assigned CVE-2026-31986, CVSS 9.1 Critical) exploits two architectural weaknesses in sequence. First, a hard-coded cryptographic key (CWE-321) used for JWT token signing. OFBiz ships a 64-character HMAC512 signing key in its public source repository at `framework/security/config/security.properties`: the value `%D*G-JaNdRgUkXp2s5v8y/B?E(H+MbPeShVmYq3t6w9z$C&F)J@NcRfTjWnZr4u7`. Every installation retaining the default configuration signs tokens with a secret that anyone can read from the open-source repository. An attacker forges a JWT with the admin claim, which OFBiz fully trusts, granting admin-level session access. Second, the same key also signs the widget engine's callback tokens. A token field names a screen area to render; OFBiz reads that field and pipes it into a FreeMarker template expander that evaluates embedded `${groovy:...}` scriptlets. An accessibility preference flag determines whether Groovy evaluation is enabled, and only an administrator can flip it. The forged admin session flips this flag, then sends a token with a malicious Groovy command replacing the screen name. OFBiz's denylist blocks script injection by matching lowercase text and known prefixes, but two bypasses exist: a capital-P `ProcessBuilder` slips past, and an auto-imported Java class requiring no prefix also bypasses the denylist. The attack requires only two unauthenticated GET requests to achieve full remote code execution on any OFBiz installation with single sign-on enabled. The CISA-ADP SSVC assessment rates exploitation as currently 'none' (no known in-the-wild exploitation), but 'automatable' (yes) and 'technical impact' (total). Other CVEs fixed in OFBiz 24.09.06 include CVE-2026-46586 (Groovy eval injection in traverseContent, CVSS 8.8) and CVE-2026-45434 (authentication bypass via password-change logic flaw, CVSS 9.8).

HelpNetSecurity identified five repeating enterprise Java security weak spots across Novee's findings: (1) web configuration protects direct requests but passes forwarded ones (Bonita forward bypass); (2) filter matching on substrings (Bonita auth/CSRF filters); (3) a single signing key authorizing separate features (OFBiz SSO + widget tokens); (4) denylist guarding script evaluation (OFBiz Groovy filter); and (5) a preference flag gating dangerous code (OFBiz accessibility toggle). The researchers emphasized that these vulnerabilities evade signature-based scanners because each component appears benign in isolation—a stray URL segment, a default key, a missing case flag on a regex—the exploit lives in how the pieces connect. Novee's research methodology was predominantly human-led, with targeted assistance from their offensive AI agent; findings from this work feed back into their model tuning.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1071 Application Layer Protocol
- T1588.002 Obtain Capability
- T1588.005 Obtain Capability
- T1588.006 Obtain Capability
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Defense Evasion
- T1027.010 Obfuscated Files or Information
- T1562 Impair Defenses
- T1552.001 Unsecured Credentials
- T1606 Forge Web Credentials

## Sources

- [Pre-auth RCE in Java Bonita, OFBiz (CVE-2026-31986)](https://www.helpnetsecurity.com/2026/08/05/pre-auth-rce-java-bonita-ofbiz-cve-2026-31986/)
- [NVD Detail for CVE-2026-31986](https://nvd.nist.gov/vuln/detail/CVE-2026-31986)
- [Apache OFBiz Security Page](https://ofbiz.apache.org/security.html)
- [OSS-Security Disclosure: CVE-2026-31986](https://www.openwall.com/lists/oss-security/2026/05/19/25)
- [Apache OFBiz Release Notes 24.09.06](https://ofbiz.apache.org/release-notes/24.09.06.html)
- [Novee Researchers to Present Four Sessions at Black Hat USA and DEF CON 2026](https://www.globenewswire.com/news-release/2026/07/28/3334295/0/en/Novee-Researchers-to-Present-Four-Sessions-across-Black-Hat-USA-and-DEF-CON-Uncovering-Vulnerabilities-in-Anthropic-OpenAI-and-Google.html)
- [Bonita 2025.2 Release Notes (Security Fixes)](https://documentation.ofelia.com/bonita/2025.2/release-notes)
- [CISA-ADP SSVC Assessment for CVE-2026-31986](https://nvd.nist.gov/vuln/detail/CVE-2026-31986#cisa-adp)
- [Apache OFBiz CVE-2026-46586 Groovy Eval Injection (GitHub PoC)](https://github.com/lwd3c/CVE-2026-46586)
- [CVE-2026-31986 Fix Commit (GitHub)](https://github.com/apache/ofbiz-framework/commit/6ba1356af67dbda4848f4c852b9ad8d3afb545c1)
- [Black Hat USA 2026 Briefings Schedule](https://blackhat.com/us-26/briefings/schedule/)
- [Novee Security Blog: Black Hat 2026 Briefings](https://novee.security/blog/black-hat-2026-briefings-ai-offensive-security/)
- [PlanetJon Analysis: CVE-2026-45434 Auth Bypass and RCE Chain in Apache OFBiz](https://www.planetjon.net/news/cybersecurity/critical-authentication-bypass-and-rce-chain-in-apache-ofbiz/)
- [GitHub Advisory: GHSA-xj47-w234-57fj](https://github.com/advisories/ghsa-xj47-w234-57fj)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1898