Description
Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with #{ that are stored and later evaluated in the full Spring context when a mail task uses variable-backed body fields, enabling method invocation on application beans.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Activiti Activiti
Default version status: unaffected
0 to ≤ 7.1.0.M6affected
pkg:maven/org.activiti/activiti-engineReferences
- https://github.com/Activiti/Activiti/issues/5438 ↗
- https://github.com/Activiti/Activiti ↗
- https://github.com/Activiti/Activiti/blob/7.1.0.M6/activiti-core/activiti-api-impl/activiti-api-process-runtime-impl/src/main/java/org/activiti/runtime/api/impl/ExpressionResolver.java ↗
- https://github.com/Activiti/Activiti/blob/7.1.0.M6/activiti-core/activiti-engine/src/main/java/org/activiti/engine/impl/bpmn/behavior/MailActivityBehavior.java ↗
- https://www.vulncheck.com/advisories/activiti-through-7.1.0-m6-expression-injection-via-mail-task ↗