[WICKET-5927] Velocity remote code execution

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 7.0.0, 1.5.14, 6.21.0
• Component/s: site
• Assignee: Martin Tzvetanov Grigorov
• Reporter: sergej m
• Created: 19/Jun/15 09:28
• Updated: 05/Jul/15 20:19
• Resolved: 20/Jun/15 12:26

Description

Hello,

arbitrary shellcode can be possibly executed, using e.g java.lang.Runtime.exec(String command) on wicket site:

http://www.wicket-library.com/wicket-examples/velocity/wicket/bookmarkable/org.apache.wicket.examples.velocity.TemplatePage?3

The server should use a secure config in org/apache/velocity/runtime/defaults/velocity.properties:

runtime.introspector.uberspect=org.apache.velocity.util.introspection.SecureUberspector

regards

Sergej Michel