[OFBIZ-11871] Server-Side Template Injection using Static

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 17.12.03
• Fix Version/s: 17.12.05, 18.12.01
• Component/s: ALL COMPONENTS
• Sprint: Bug Crush Event - 21/2/2015
• Assignee: Jacques Le Roux
• Reporter: Jacques Le Roux
• Created: 06/Jul/20 07:10
• Updated: 03/Aug/20 09:10
• Resolved: 03/Aug/20 09:10

Description

Alvaro Munoz <[e-mail]> from the GitHub Security Lab ([e-mail]) reported a Server-Side Template Injection that uses "Static" to the OFBiz security team, and we thank him for that.

I'll later quote here his email message when the vulnerability will be fixed. It's a post-auth vulnerability so we did not ask for a CVE.

Note: this vulnerabitly leads to Remote Code Execution (RCE)