^{CVE-2020-13936:}Apache Velocity Engine Sandbox Bypass Vulnerability (CVE-2020-13936)

Overview

CVE-2020-13936 affects Apache Velocity Engine, a template engine that allows developers to use a simple but powerful template language to reference objects defined in Java code. The vulnerability exists in the sandbox protection mechanism that is meant to restrict what operations can be performed within templates. An attacker with the ability to modify Velocity templates can craft malicious template content that bypasses these restrictions, leading to arbitrary code execution. This can result in complete system compromise at the privilege level of the application server.

The issue affects all versions of Apache Velocity Engine up to and including version 2.2. Applications that allow untrusted users to upload or modify templates are particularly at risk. The vulnerability was publicly disclosed on March 10, 2021, though it was identified in 2020.

Remediation

To remediate this vulnerability, the following actions are recommended:

1. Upgrade to Apache Velocity Engine version 2.3 or later, which contains the security fix for this vulnerability.

2. If upgrading is not immediately possible, implement additional security controls:

   • Restrict access to template modification to trusted users only
   • Implement strict input validation for any template content
   • Consider running the application in a containerized environment with reduced privileges

3. For applications that must allow untrusted users to modify templates:

   • Implement a custom security manager with stricter permissions
   • Consider using an alternative templating solution with stronger security guarantees
   • Apply additional security reviews to any template content before processing

4. Review server logs for any signs of exploitation attempts targeting Velocity template processing.

References

1. Apache Velocity announcement: https://lists.apache.org/thread.html/r01043f584cbd47959fabe18fff64de940f81a65024bb8dddbda31d9a%40%3Cuser.velocity.apache.org%3E
2. OSS Security mailing list discussion: http://www.openwall.com/lists/oss-security/2021/03/10/1
3. Apache announcement: https://lists.apache.org/thread.html/r3ea4c4c908505b20a4c268330dfe7188b90c84dcf777728d02068ae6%40%3Cannounce.apache.org%3E
4. Debian security update: https://lists.debian.org/debian-lts-announce/2021/03/msg00019.html
5. Gentoo security advisory: https://security.gentoo.org/glsa/202107-52
6. Oracle Critical Patch Updates: https://www.oracle.com/security-alerts/cpuapr2022.html and https://www.oracle.com/security-alerts/cpujan2022.html