[ https://issues.apache.org/jira/browse/OFBIZ-11709?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jacques Le Roux closed OFBIZ-11709. ----------------------------------- Fix Version/s: 17.12.04 18.12.01 Resolution: Fixed > Prevent FreeMarker Template Injection (SSTI) > -------------------------------------------- > > Key: OFBIZ-11709 > URL: https://issues.apache.org/jira/browse/OFBIZ-11709 > Project: OFBiz > Issue Type: Sub-task > Components: framework > Affects Versions: Release Branch 18.12, Release Branch 17.12, Trunk > Reporter: Jacques Le Roux > Assignee: Jacques Le Roux > Priority: Critical > Fix For: 18.12.01, 17.12.04 > > > This issue was initially reported to the security team by Alvaro Munoz > <pwntes...@github.com> from the GitHub Security Lab team > <security...@github.com>. It was also reported 15 days later by Kai Zhao > <happyhack...@outlook.it>. > It's a well known *post-auth *vulnerability[1][2][3] so *no CVE* was created. > It relies on Freemarker freemarker.template.utility.Execute class and new() > built-in. > Since Freemarker 2.3.17 a known solution to these issues is to register a > TemplateClassResolver in Freemarker configuration in order to limit which > TemplateModels can be instantiated in the templates. The predefined resolver > SAFER_RESOLVER doesn�t allow to instantiate the Execute class[4]. So the > solution is to add the line > {code:java} > newConfig.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER); > {code} > in FreeMarkerWorker.java > In [1] a concern about the Freemarker api buit-in is mentioned. Actually this > is not a concern by default in Freemarker[5] and OFBiz > bq. The api_builtin_enabled configuration setting must be set to true. Its > default is false (at least as of 2.3.22) for not lowering the security of > existing applications. > [1] https://ackcent.com/blog/in-depth-freemarker-template-injection/ > [2] https://insinuator.net/2016/07/dilligent-bug/ > [3] https://portswigger.net/research/server-side-template-injection > [4] > https://freemarker.apache.org/docs/api/freemarker/core/TemplateClassResolver.html#SAFER_RESOLVER > [5] > https://freemarker.apache.org/docs/ref_builtins_expert.html#ref_buitin_api_and_has_api -- This message was sent by Atlassian Jira (v8.3.4#803005)