Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engine

Vulnerability

A stored injection vulnerability exists in Dromara lamp-cloud up to version 5.6.2 within the message template handler. The DefMsgTemplate.content field is processed by GroovyClassLoader.parseClass() and subsequently executed via InvokerHelper.createScript().run() without proper sanitization. Additionally, the DefMsgTemplate.script and DefInterface.script fields can contain arbitrary Groovy code evaluated in the same manner, and the content field is also subject to FreeMarker Server-Side Template Injection (SSTI). No validation is performed on the script or content fields [1].

Exploitation

An attacker with network access and administrative privileges can POST malicious Groovy code to the /defMsgTemplate or /defInterface endpoints. The code is stored in the database and later evaluated when messages are processed, resulting in remote code execution. The public exploit details are available [1].

Impact

Successful exploitation results in remote code execution with the privileges of the application server. This can lead to full compromise of the server, including data disclosure, modification, and denial of service.

Mitigation

As of the publication date, the vendor has not responded and no patch is available. Users should restrict network access to administrative endpoints, monitor for suspicious activity, and consider disabling the message template feature if possible [1].