[
https://issues.apache.org/jira/browse/FREEMARKER-202?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461690#comment-17461690
]
Dániel Dékány commented on FREEMARKER-202:
------------------------------------------
As far as I can tell that method is blocked by default, since 2.3.30. Can you
demonstrate this issue on 2.3.30 or later?
As of this kind of attacks in general, please: see
[https://freemarker.apache.org/docs/app_faq.html#faq_template_uploading_security]
> SRCCLR-SID-30023 - SSTI
> ------------------------
>
> Key: FREEMARKER-202
> URL: https://issues.apache.org/jira/browse/FREEMARKER-202
> Project: Apache Freemarker
> Issue Type: Bug
> Reporter: KV
> Priority: Major
> Labels: security
>
> Long-standing vulnerability.
> [https://sca.analysiscenter.veracode.com/vulnerability-database/security/server-side-template-injection-ssti/java/sid-30023]
> freemarker is vulnerable to server-side template injection (SSTI). By using
> `java.security.ProtectionDomain.getClassLoader` templates, an attacker is
> able to gain access to the classloader and subsequently the filesystem or
> execute arbitrary code on the host OS.
> Please fix ASAP.
>
> SRCCLR-SID-30023
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
