Server-side Template Injection (SSTI) Affecting org.freemarker:freemarker Open this link in a new tab package, versions [,2.3.30)
Exploit Maturity
Proof of concept
Attack Complexity
High
Confidentiality
High
Integrity
High
Availability
High
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-JAVA-ORGFREEMARKER-1076795
-
published
19 Feb 2021
-
disclosed
9 Apr 2020
-
credit
Ackcent
Introduced: 9 Apr 2020
CWE-94 Open this link in a new tabHow to fix?
Upgrade org.freemarker:freemarker
to version 2.3.30 or higher.
Overview
org.freemarker:freemarker is a "template engine"; a generic tool to generate text output (anything from HTML to auto generated source code) based on templates.
Affected versions of this package are vulnerable to Server-side Template Injection (SSTI). By allowing user input into java.security.ProtectionDomain.getClassLoader
, templates will get access to the java classloader. This can be further leveraged for file system access and code execution. A low-privileged user is sufficient for exploitation of this vulnerability.