CVE-2025-57738: Apache Syncope allows malicious administrators to inject Groovy code
(updated )
Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machinery is set for runtime reload. Such a feature has been available for a while, but recently it was discovered that a malicious administrator can inject Groovy code that can be executed remotely by a running Apache Syncope Core instance. Users are recommended to upgrade to version 3.0.14 / 4.0.2, which fix this issue by forcing the Groovy code to run in a sandbox.
References
- github.com/advisories/GHSA-825g-mm5v-ggq4
- github.com/apache/syncope/commit/88c2b5b0be9e2ed66007d672e786165bc266e717
- github.com/apache/syncope/commit/8b08c4d5785599a0e38830dcff89738b93f02a16
- issues.apache.org/jira/browse/SYNCOPE-1907
- lists.apache.org/thread/x7cv6xv7z76y49grdr1hgj1pzw5zbby6
- nvd.nist.gov/vuln/detail/CVE-2025-57738
- syncope.apache.org/security
Code Behaviors & Features
Detect and mitigate CVE-2025-57738 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →