Apache OFBiz: renderLink compiles link parameters as FreeMarker source

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp (e.g. CATALOG_VIEW and OFBTOOLS_VIEW on /catalog, held by OFBiz's own shipped order-entry clerk role) to execute arbitrary operating system commands as the OFBiz service account with a single GET request, by placing an apostrophe followed by FreeMarker expression source in a screen link parameter value, because renderLink concatenates link parameter values verbatim between apostrophes into an unquoted, unescaped template-source string that is compiled and evaluated at render time, allowing the injected expression to reach the allow-listed FlexibleStringExpander.expandString call and, through a runtime-assembled Groovy interpolation, unsandboxed code execution. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz Üretici bülteni

Kayıt geçmişi

1. 5 Kas 2026 19:30CVSS puanı değişti: – → 8.8
2. 5 Kas 2026 17:03Yayımlandı

İlgili açıklar

• 4,3 CVE-2026-82902Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile
• 7,5 CVE-2026-82904Apache OFBiz'te parametre adına bağlı sınırsız çoklu form satır sayısı hatası
• 9,8 CVE-2026-82907Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound
• 8,8 CVE-2026-82912Apache OFBiz: Unsandboxed Groovy compiled from a service parameter
• 7,1 CVE-2026-82916Apache OFBiz: webtools xmldsdump exports any entity to any path
• 8,8 CVE-2026-82960Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE