| शीर्षक | Github ShifuML 0.12.0 Expression Language Injection |
|---|
| विवरण | Description:
The Shifu project of ShifuML https://github.com/ShifuML/shifu is vulnerable to Java Expression Language Injection Via FilterExpression parameter.
Impact:
The quick impact here is Code Execution, but depending upon how the project is being used it can either lead to Initial Access Via Remote Code Execution or Local Privilege Escalation VIA Rce if the Shifu binary is being given sudo permission.
Steps To Reproduce:
Check out the Proof-Of-Concept Video.
RootCause:
https://github.com/ShifuML/shifu/blob/20f589158adfc011c505664cf7bdf31e36ed62fa/src/main/java/ml/shifu/shifu/core/DataPurifier.java#L53
There are multiple occurrences of JEXL.CreateExpression and evaluation.
All them can lead to Code Execution.
Mitigation:
JEXL Expression should be evaluated in a sandboxed Environment.
https://blog.gypsyengineer.com/en/security/detecting-jexl-injections-with-codeql.html |
|---|
| स्रोत | ⚠️ https://drive.google.com/file/d/1ST3dD-iwUBgBNZ8tGaBbqVi1zRh5rLND/view?usp=sharing |
|---|
| उपयोगकर्ता | w3bspl01t3r (UID 39229) |
|---|
| सबमिशन | 26/12/2023 09:50 PM (3 साल पहले) |
|---|
| संयम | 28/12/2023 09:48 AM (1 day later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 249151 [ShifuML shifu 0.12.0 Java Expression Language DataPurifier.java FilterExpression अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|