GitHub Advisoryadvisory · Maven

GHSA-9gh8-877r-g477 Beetl Server-Side Template Injection vulnerability

CRITICAL Published 2024-02-02 Modified 2024-02-12 Official page ↗
Aliases
CVE-2024-22533
Ecosystem
Maven
Packages
com.ibeetl:beetl-core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2024-02-02

Affected packages

• Maven com.ibeetl:beetl-core: < 3.15.13.RELEASE → fixed in 3.15.13.RELEASE

Description

Before Beetl v3.15.13.RELEASE, the rendering template has a server-side template injection (SSTI) vulnerability. When the incoming template is controllable, it will be filtered by the DefaultNativeSecurityManager blacklist. Because blacklist filtering is not strict, the blacklist can be bypassed, leading to arbitrary code execution.

Related

Alias · CVE (1)

  • CVE-2024-22533 Before Beetl v3.15.12, the rendering template has a server-side template injection (SSTI) vulnerability. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References