| शीर्षक | Openboxes v0.9.7 Command Injection |
|---|
| विवरण | A Server-Side Template Injection (SSTI) vulnerability leading to Remote Code Execution (RCE) exists in OpenBoxes versions v0.9.6 and earlier. An authenticated user with Manager privileges can upload a malicious document containing Groovy Server Pages (GSP) expressions, while any authenticated user with Browser privileges can trigger its execution through the `buildZebraTemplate` endpoint. Due to missing document type validation in `DocumentController.groovy` and the unsafe use of `GroovyPagesTemplateEngine.createTemplate()` in `TemplateService.groovy`, attacker-controlled template content is evaluated as Groovy code on the server. Successful exploitation allows arbitrary command execution, resulting in full server compromise, data exfiltration, persistent backdoors, and lateral movement within the affected environment.
This vulnerability was fixed in OpenBoxes v0.9.8.
timeline:
January 11, 2026 – Vulnerability discovered and reported to the OpenBoxes maintainers.
February 2, 2026 – Vulnerability acknowledged by the development team.
June 13, 2026 – Security patch officially released, fixing the unvalidated URL.openStream() call.
patch and fix: https://github.com/openboxes/openboxes/pull/5943
github advisory (not published) used to report: https://github.com/openboxes/openboxes/security/advisories/GHSA-8wxj-vghp-jpcq |
|---|
| स्रोत | ⚠️ https://gist.github.com/nedlir/220a30213b5a5c6bc26d1000012c6a4d |
|---|
| उपयोगकर्ता | nedlir (UID 95981) |
|---|
| सबमिशन | 27/06/2026 03:48 PM (2 महीनों पहले) |
|---|
| संयम | 15/08/2026 07:47 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 390180 [OpenBoxes तक 0.9.6 Template Processing DocumentController.groovy buildZebraTemplate अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|