PT-2020-15192 · Apache · Apache Syncope

Published 2020-05-04 · Updated 2021-07-21 · CVE-2020-1959

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Syncope versions prior to 2.1.6

Description A Server-Side Template Injection issue allows attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution (RCE) vulnerability. Apache Syncope uses Java Bean Validation custom constraint validators that support interpolation, including Java EL expressions. If an attacker can inject arbitrary data in the error message template, they will be able to run arbitrary Java code.

Recommendations For versions prior to 2.1.6, update to version 2.1.6 or later to resolve the issue. As a temporary workaround, consider restricting access to custom constraint violation error messages to minimize the risk of exploitation. Avoid using Java EL expressions in error message templates until the issue is resolved.

Fix

Weakness Enumeration

CWE-917

Related Identifiers

CVE-2020-1959

GHSA-VJQW-R3WW-WJ2W

Affected Products

Apache Syncope

References · 5

• http://syncope.apache.org/security · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vjqw-r3ww-wj2w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-1959 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1959 · Security Note
• https://t.me/cvenotify/3509 · Telegram Post