[jira] [Commented] (FREEMARKER-202) SRCCLR-SID-30023 - SSTI

["Dániel Dékány (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/FREEMARKER-202?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17461690#comment-17461690 ] 

Dániel Dékány commented on FREEMARKER-202:
------------------------------------------

As far as I can tell that method is blocked by default, since 2.3.30. Can you demonstrate this issue on 2.3.30 or later?

As of this kind of attacks in general, please: see [https://freemarker.apache.org/docs/app_faq.html#faq_template_uploading_security]

> SRCCLR-SID-30023 - SSTI 
> ------------------------
>
>                 Key: FREEMARKER-202
>                 URL: https://issues.apache.org/jira/browse/FREEMARKER-202
>             Project: Apache Freemarker
>          Issue Type: Bug
>            Reporter: KV
>            Priority: Major
>              Labels: security
>
> Long-standing vulnerability.
> [https://sca.analysiscenter.veracode.com/vulnerability-database/security/server-side-template-injection-ssti/java/sid-30023]
> freemarker is vulnerable to server-side template injection (SSTI). By using `java.security.ProtectionDomain.getClassLoader` templates, an attacker is able to gain access to the classloader and subsequently the filesystem or execute arbitrary code on the host OS.
> Please fix ASAP.
>  
> SRCCLR-SID-30023



--
This message was sent by Atlassian Jira
(v8.20.1#820001)