GitHub Advisoryadvisory · Maven

GHSA-fv3m-xhqw-9m79 ballcat-codegen template engine remote code execution injection

HIGH Published 2022-04-27 Modified 2022-04-27 Official page ↗
Aliases
CVE-2022-24881
Ecosystem
Maven
Packages
com.hccake:ballcat-codegen
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-78
Reviewed
2022-04-27

Affected packages

• Maven com.hccake:ballcat-codegen: < 1.0.0.beta.2 → fixed in 1.0.0.beta.2

Description

Impact Ballcat Codegen provides the function of online editing code to generate templates. In version < 1.0.0.beta.2, since Velocity and freemarker templates are introduced but input verification is not done, attackers can implement remote code execution through malicious code injection of the template engine. Patches The fault is rectified and needs to be upgraded to the latest version.

Related

Alias · CVE (1)

  • CVE-2022-24881 Ballcat Codegen provides the function of online editing code to generate templates. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References