CVE-2018-18893: Jinjava getClass Method Vulnerability
Summary
CVE-2018-18893: Jinjava calls getClass. Affects com.hubspot.jinjava:jinjava versions < 2.4.6. Fixed in 2.4.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jinjava is an open-source template engine for Java that allows developers to embed dynamic content in static HTML pages. It provides a powerful set of features for rendering templates and processing expressions. The vulnerability in Jinjava versions prior to 2.4.6 allows the execution of the getClass method, which can lead to potential security risks.
Vulnerability Detail
The vulnerability arises from the failure to block the getClass method in JinjavaBeanELResolver.java. This oversight enables an attacker to execute arbitrary code and potentially gain unauthorized access to sensitive information or perform malicious actions on the affected system. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.4.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually modify the JinjavaBeanELResolver.java file to block the getClass method. Here is an example of the code modification:
public class JinjavaBeanELResolver extends BeanELResolver {
@Override
public Object getValue(ELContext context, Object base, Object property) {
if (property.equals("class")) {
throw new PropertyNotFoundException();
}
return super.getValue(context, base, property);
}
}
Conclusion
In conclusion, the Jinjava getClass Method Vulnerability (CVE-2018-18893) poses a moderate security risk. It is crucial to update the Jinjava library to version 2.4.6 or later to fix this vulnerability and prevent potential exploitation. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.hubspot.jinjava:jinjava →
FAQ
Jinjava is an open-source template engine for Java that allows developers to embed dynamic content in static HTML pages. It provides a powerful set of features for rendering templates and processing expressions.
This vulnerability allows an attacker to execute arbitrary code and potentially gain unauthorized access to sensitive information or perform malicious actions on the affected system.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
To fix this vulnerability, it is recommended to update the Jinjava library to version 2.4.6 or later. This version includes the necessary security patches to block the getClass method and mitigate the associated risks.
Yes, as a temporary workaround, developers can manually modify the JinjavaBeanELResolver.java file to block the getClass method. Please refer to the 'workaround' section for the code modification.
Related vulnerabilities
Recent vulnerabilities recorded for com.hubspot.jinjava:jinjava.
