Server-Side Template Injection

2020-06-1704:45:15

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.002 Low

EPSS

Percentile

60.7%

JSON

conductor-core is vulnerable to server-side template injection. The vulnerability exists as it was using hibernate-validator in a custom constraint validator, where user-input that were not properly validated against a validation mapping configuration can reach the error message template, allowing arbitrary code to be interpreted and executed.

CPENameOperatorVersion
conductor-corele2.25.2-alpha.2
conductor-corele2.25.2-alpha.2

CPE	Name	Operator	Version
	conductor-core	le	2.25.2-alpha.2
	conductor-core	le	2.25.2-alpha.2

References

github.com/Netflix/conductor/commit/86b26785c91dd8f635fce486634108354344f200

github.com/Netflix/conductor/pull/1543

github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-001.md

github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-002.md

0.002 Low

EPSS

Percentile

60.7%

JSON

Related for VERACODE:25697