Uploaded image for project: 'OFBiz'
  1. OFBiz
  2. OFBIZ-1525 Issue to group security concerns
  3. OFBIZ-11709

Prevent FreeMarker Template Injection (SSTI)

    XMLWordPrintableJSON

    Details

    • Type: Sub-task
    • Status: Closed
    • Priority: Critical
    • Resolution: Fixed
    • Affects Version/s: Release Branch 18.12, Release Branch 17.12, Trunk
    • Fix Version/s: 18.12.01, 17.12.04
    • Component/s: framework
    • Labels:
      None
    • Sprint:
      Bug Crush Event - 21/2/2015

      Description

      This issue was initially reported to the security team by Alvaro Munoz <pwntester@github.com> from the GitHub Security Lab team <securitylab@github.com>. It was also reported 15 days later by Kai Zhao <happyhacking@outlook.it>.

      It's a well known post-auth vulnerability[1][2][3] so no CVE was created. It relies on Freemarker freemarker.template.utility.Execute class and new() built-in.

      Since Freemarker 2.3.17 a known solution to these issues is to register a TemplateClassResolver in Freemarker configuration in order to limit which TemplateModels can be instantiated in the templates. The predefined resolver SAFER_RESOLVER doesn't allow to instantiate the Execute class[4]. So the solution is to add the line

      newConfig.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER);
      

      in FreeMarkerWorker.java

      In [1] a concern about the Freemarker api buit-in is mentioned. Actually this is not a concern by default in Freemarker[5] and OFBiz

      The api_builtin_enabled configuration setting must be set to true. Its default is false (at least as of 2.3.22) for not lowering the security of existing applications.

      [1] https://ackcent.com/blog/in-depth-freemarker-template-injection/
      [2] https://insinuator.net/2016/07/dilligent-bug/
      [3] https://portswigger.net/research/server-side-template-injection
      [4] https://freemarker.apache.org/docs/api/freemarker/core/TemplateClassResolver.html#SAFER_RESOLVER
      [5] https://freemarker.apache.org/docs/ref_builtins_expert.html#ref_buitin_api_and_has_api

        Attachments

          Activity

            People

            • Assignee:
              jleroux Jacques Le Roux
              Reporter:
              jleroux Jacques Le Roux
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: