CVE-2020-13936: Sandbox Bypass in Apache Velocity Engine
Summary
CVE-2020-13936: Sandbox Bypass in Apache Velocity Engine. Affects org.apache.velocity:velocity-engine-parent versions < 2.3. Fixed in 2.3. How to fix ↓
Also tracked for
- velocity · Debian:11
The same CVE-2020-13936 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Apache Velocity Engine is a powerful template engine that allows developers to render dynamic content in Java applications. It is widely used in various frameworks and applications to generate HTML, XML, and other text-based output. The vulnerability, identified as CVE-2020-13936, affects Apache Velocity Engine versions up to 2.2. It allows an attacker who can modify Velocity templates to execute arbitrary Java code or run system commands with the same privileges as the account running the Servlet container. This vulnerability poses a significant security risk to applications that allow untrusted users to upload or modify Velocity templates.
Vulnerability Detail
The vulnerability arises from a lack of proper input validation and sandboxing in the Apache Velocity Engine. When an attacker is able to modify Velocity templates, they can inject malicious Java code or system commands. This code or commands will be executed within the context of the Servlet container, potentially leading to unauthorized access, data leakage, or even complete compromise of the affected system. The impact of this vulnerability is severe, as it allows an attacker to bypass the intended security measures and gain unauthorized control over the application.
How To Fix
Minimum fixed version
2.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a possible workaround is to disable the ability for untrusted users to upload or modify Velocity templates. This can be achieved by implementing strict access controls and validation checks on template uploads. It is also recommended to review and sanitize any existing templates to remove any potential vulnerabilities. However, this workaround is not a comprehensive solution and should be considered temporary until the underlying vulnerability is addressed.
Conclusion
The CVE-2020-13936 vulnerability in Apache Velocity Engine poses a significant security risk to applications that allow untrusted users to upload or modify Velocity templates. It allows attackers to execute arbitrary Java code or run system commands with the same privileges as the Servlet container. To mitigate this risk, it is crucial to upgrade to Apache Velocity Engine version 2.3 or later and implement proper input validation and sanitization. Vulert's playground can be used to check if your application is affected by this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.velocity:velocity-engine-parent →
FAQ
The impact of this vulnerability is severe. An attacker who can modify Velocity templates can execute arbitrary Java code or run system commands with the same privileges as the Servlet container. This can lead to unauthorized access, data leakage, or complete compromise of the affected system.
Apache Velocity Engine versions up to 2.2 are affected by this vulnerability.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly address this issue to mitigate the risk of potential attacks.
Yes, the CVSS score for this vulnerability is 8.8, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert provides real-time monitoring and alerts for open-source vulnerabilities in software, using just the pom.xml file without requiring access to the code or installation.
