Description
Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
floci-io floci
Default version status: unaffected
1.1.0 to < 2.2.0affected
pkg:github/floci-io/flociReferences
- https://github.com/floci-io/floci/security/advisories/GHSA-3p4c-wp7w-mgjx ↗
- https://github.com/ghostx-86/exploitarium/tree/main/floci-apigateway-vtl-rce-poc ↗
- https://github.com/floci-io/floci/commit/144b90e6fa861a5ac882e99a090d503da01945c4 ↗
- https://github.com/floci-io/floci/releases/tag/2.2.0 ↗
- https://github.com/floci-io/floci/blob/560b3e4aae61cea3ac7d4d51843bdffd0e3085fd/src/main/java/io/github/hectorvent/floci/services/apigateway/VtlTemplateEngine.java#L74-L114 ↗
- https://github.com/floci-io/floci ↗
- https://www.vulncheck.com/advisories/floci-1.1.0-before-2.2.0-rce-via-api-gateway-vtl-mapping-templates ↗