| शीर्षक | xianrendzw EasyReport <=2.0.17.0522_Beta remote code execution |
|---|
| विवरण | The report designer's SQL preview endpoints (execSqlText, previewSqlText) pass an attacker-supplied sqlText parameter directly to the Apache Velocity template engine via Velocity.evaluate. The evaluation context exposes live Java classes (DateUtils.class, StringUtils.class, Calendar), and no Velocity security guard (SecureUberspector, MethodExceptionEventHandler) is configured anywhere in the project. As a result the template engine can be driven to reflective class access, which leads to remote code execution. The endpoints are reachable by any authenticated user holding the low report.designer:view permission; all /rest/** routes are guarded by Shiro authentication. |
|---|
| स्रोत | ⚠️ https://github.com/xianrendzw/EasyReport/issues/82 |
|---|
| उपयोगकर्ता | Ana10gy (UID 93358) |
|---|
| सबमिशन | 02/07/2026 11:44 AM (2 महीनों पहले) |
|---|
| संयम | 18/08/2026 08:19 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 391897 [xianrendzw EasyReport तक 2.0.17.0522_Beta SQL Preview Endpoint DesignerController.java execSqlText/previewSqlText sqlText अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|