[MAVEN:GHSA-9GH8-877R-G477] Beetl Server-Side Template Injection vulnerability

Severity Moderate

Affected Packages 2

Fixed Packages 2

CVEs 1

Before Beetl v3.15.12, the rendering template has a server-side template injection (SSTI) vulnerability. When the incoming template is controllable, it will be filtered by the DefaultNativeSecurityManager blacklist. Because blacklist filtering is not strict, the blacklist can be bypassed, leading to arbitrary code execution.

Package	Affected Version
pkg:maven/com.ibeetl/beetl-core	< 3.15.13.RELEASE
pkg:maven/com.ibeetl/beetl	< 3.15.12

Package	Fixed Version
pkg:maven/com.ibeetl/beetl-core	= 3.15.13.RELEASE
pkg:maven/com.ibeetl/beetl	= 3.15.12

ID: MAVEN:GHSA-9GH8-877R-G477
Severity: moderate
URL: https://github.com/advisories/GHSA-9gh8-877r-g477
Published: 2024-02-02T03:30:32
(7 months ago)
Modified: 2024-02-02T18:10:31
(7 months ago)
Rights: Maven Security Team

Source	# ID	Name	URL
			https://nvd.nist.gov/vuln/detail/CVE-2024-22533
			https://gitee.com/xiandafu/beetl/issues/I8RU01
			https://github.com/advisories/GHSA-9gh8-877r-g477

Type	Package URL	Namespace	Name / Product	Version
Affected	pkg:maven/com.ibeetl/beetl-core	com.ibeetl	beetl-core	< 3.15.13.RELEASE
Fixed	pkg:maven/com.ibeetl/beetl-core	com.ibeetl	beetl-core	= 3.15.13.RELEASE
Affected	pkg:maven/com.ibeetl/beetl	com.ibeetl	beetl	< 3.15.12
Fixed	pkg:maven/com.ibeetl/beetl	com.ibeetl	beetl	= 3.15.12

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date