[ 
https://issues.apache.org/jira/browse/OFBIZ-11709?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
 ]

Jacques Le Roux updated OFBIZ-11709:
------------------------------------
    Description: 
This issue was initially reported to the security team by Alvaro Munoz 
<pwntes...@github.com> from the GitHub Security Lab team 
<security...@github.com>. It was also reported 15 days later by Kai Zhao 
<happyhack...@outlook.it>.

It's a well known *post-auth* vulnerability[1][2][3] so *no CVE* was created. 
It relies on Freemarker freemarker.template.utility.Execute class and new() 
built-in.

Since Freemarker 2.3.17 a known solution to these issues is to register a 
TemplateClassResolver in Freemarker configuration in order to limit which 
TemplateModels can be instantiated in the templates. The predefined resolver 
SAFER_RESOLVER doesn�t allow to instantiate the Execute class[4]. So the 
solution is to add the line

{code:java}
newConfig.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER);
{code}

in FreeMarkerWorker.java

In [1] a concern about the Freemarker api buit-in is mentioned. Actually this 
is not a concern by default in Freemarker[5] and OFBiz

bq. The api_builtin_enabled configuration setting must be set to true. Its 
default is false (at least as of 2.3.22) for not lowering the security of 
existing applications.

[1] https://ackcent.com/blog/in-depth-freemarker-template-injection/
[2] https://insinuator.net/2016/07/dilligent-bug/
[3] https://portswigger.net/research/server-side-template-injection
[4] 
https://freemarker.apache.org/docs/api/freemarker/core/TemplateClassResolver.html#SAFER_RESOLVER
[5] 
https://freemarker.apache.org/docs/ref_builtins_expert.html#ref_buitin_api_and_has_api

  was:
This issue was initially reported to the security team by Alvaro Munoz 
<pwntes...@github.com> from the GitHub Security Lab team 
<security...@github.com>. It was also reported 15 days later by Kai Zhao 
<happyhack...@outlook.it>.

It's a well known *post-auth *vulnerability[1][2][3]* so *no CVE* was created. 
It relies on Freemarker freemarker.template.utility.Execute class and new() 
built-in.

Since Freemarker 2.3.17 a known solution to these issues is to register a 
TemplateClassResolver in Freemarker configuration in order to limit which 
TemplateModels can be instantiated in the templates. The predefined resolver 
SAFER_RESOLVER doesn�t allow to instantiate the Execute class[4]. So the 
solution is to add the line

{code:java}
newConfig.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER);
{code}

in FreeMarkerWorker.java

In [1] a concern about the Freemarker api buit-in is mentioned. Actually this 
is not a concern by default in Freemarker[5] and OFBiz

bq. The api_builtin_enabled configuration setting must be set to true. Its 
default is false (at least as of 2.3.22) for not lowering the security of 
existing applications.

[1] https://ackcent.com/blog/in-depth-freemarker-template-injection/
[2] https://insinuator.net/2016/07/dilligent-bug/
[3] https://portswigger.net/research/server-side-template-injection
[4] 
https://freemarker.apache.org/docs/api/freemarker/core/TemplateClassResolver.html#SAFER_RESOLVER
[5] 
https://freemarker.apache.org/docs/ref_builtins_expert.html#ref_buitin_api_and_has_api


> Prevent FreeMarker Template Injection (SSTI)
> --------------------------------------------
>
>                 Key: OFBIZ-11709
>                 URL: https://issues.apache.org/jira/browse/OFBIZ-11709
>             Project: OFBiz
>          Issue Type: Sub-task
>          Components: framework
>    Affects Versions: Release Branch 18.12, Release Branch 17.12, Trunk
>            Reporter: Jacques Le Roux
>            Assignee: Jacques Le Roux
>            Priority: Critical
>             Fix For: 18.12.01, 17.12.04
>
>
> This issue was initially reported to the security team by Alvaro Munoz 
> <pwntes...@github.com> from the GitHub Security Lab team 
> <security...@github.com>. It was also reported 15 days later by Kai Zhao 
> <happyhack...@outlook.it>.
> It's a well known *post-auth* vulnerability[1][2][3] so *no CVE* was created. 
> It relies on Freemarker freemarker.template.utility.Execute class and new() 
> built-in.
> Since Freemarker 2.3.17 a known solution to these issues is to register a 
> TemplateClassResolver in Freemarker configuration in order to limit which 
> TemplateModels can be instantiated in the templates. The predefined resolver 
> SAFER_RESOLVER doesn�t allow to instantiate the Execute class[4]. So the 
> solution is to add the line
> {code:java}
> newConfig.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER);
> {code}
> in FreeMarkerWorker.java
> In [1] a concern about the Freemarker api buit-in is mentioned. Actually this 
> is not a concern by default in Freemarker[5] and OFBiz
> bq. The api_builtin_enabled configuration setting must be set to true. Its 
> default is false (at least as of 2.3.22) for not lowering the security of 
> existing applications.
> [1] https://ackcent.com/blog/in-depth-freemarker-template-injection/
> [2] https://insinuator.net/2016/07/dilligent-bug/
> [3] https://portswigger.net/research/server-side-template-injection
> [4] 
> https://freemarker.apache.org/docs/api/freemarker/core/TemplateClassResolver.html#SAFER_RESOLVER
> [5] 
> https://freemarker.apache.org/docs/ref_builtins_expert.html#ref_buitin_api_and_has_api



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

Reply via email to