Findings for SCA, High, [TheRedHatter/javagoof:todolist-web-struts/pom.xml]:Server-side Template Injection (SSTI)
Created by: armorcodegithubpreprod[bot]
Findings for SCA, High, [TheRedHatter/javagoof:todolist-web-struts/pom.xml]:Server-side Template Injection (SSTI)
Component Details
- Exploit Maturity: proof-of-concept
- Vulnerable Package: -
- Current Version: -
- Vulnerable Version(s): >[,2.3.30)
- Vulnerable Path: >null
Overview
org.freemarker:freemarker is a "template engine"; a generic tool to generate text output (anything from HTML to auto generated source code) based on templates.
Affected versions of this package are vulnerable to Server-side Template Injection (SSTI). By allowing user input into java.security.ProtectionDomain.getClassLoader, templates will get access to the java classloader. This can be further leveraged for file system access and code execution. A low-privileged user is sufficient for exploitation of this vulnerability.
References
Snyk Project Status: Active