CVE-2020-1959: Code Injection

May 4, 2020 (updated July 21, 2021)

A Server-Side Template Injection in Apache Syncope enables attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution (RCE) vulnerability. Apache Syncope uses Java Bean Validation (JSR) custom constraint validators. When building custom constraint violation error messages, they support different types of interpolation, including Java EL expressions. Therefore, if an attacker can inject arbitrary data in the error message template being passed, they will be able to run arbitrary Java code.

References

syncope.apache.org/security
nvd.nist.gov/vuln/detail/CVE-2020-1959

Code Behaviors & Features

Detect and mitigate CVE-2020-1959 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →