Jacques Le Roux created OFBIZ-11709:
---------------------------------------
Summary: Prevent FreeMarker Template Injection (SSTI)
Key: OFBIZ-11709
URL: https://issues.apache.org/jira/browse/OFBIZ-11709
Project: OFBiz
Issue Type: Sub-task
Components: framework
Affects Versions: Trunk, Release Branch 18.12, Release Branch 17.12
Reporter: Jacques Le Roux
Assignee: Jacques Le Roux
This issue was initially reported to the security team by Alvaro Munoz
<[email protected]> from the GitHub Security Lab team
<[email protected]>. It was also reported 15 days later by Kai Zhao
<[email protected]>.
It's a well known *post-auth *vulnerability[1][2][3] so *no CVE* was created.
It relies on Freemarker freemarker.template.utility.Execute class and new()
built-in.
Since Freemarker 2.3.17 a known solution to these issues is to register a
TemplateClassResolver in Freemarker configuration in order to limit which
TemplateModels can be instantiated in the templates. The predefined resolver
SAFER_RESOLVER doesn�t allow to instantiate the Execute class[4]. So the
solution is to add the line
newConfig.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER);
in FreeMarkerWorker.java
In [1] a concern about the Freemarker api buit-in is mentioned. Actually this
is not a concern by default in Freemarker[5] and OFBiz
bq. The api_builtin_enabled configuration setting must be set to true. Its
default is false (at least as of 2.3.22) for not lowering the security of
existing applications.
[1] https://ackcent.com/blog/in-depth-freemarker-template-injection/
[2] https://insinuator.net/2016/07/dilligent-bug/
[3] https://portswigger.net/research/server-side-template-injection
[4]
https://freemarker.apache.org/docs/api/freemarker/core/TemplateClassResolver.html#SAFER_RESOLVER
[5]
https://freemarker.apache.org/docs/ref_builtins_expert.html#ref_buitin_api_and_has_api
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
