Skip to content

Latest commit

 

History

History
39 lines (27 loc) · 1.48 KB

nflx-2020-002.md

File metadata and controls

39 lines (27 loc) · 1.48 KB
Raw
Advisory ID:

NFLX-2020-002

Advisory Title:

Server-Side Template Injection in Netflix Titus

Author:

Aladdin Almubayed / amubaied@netflix.com

Release Date:

2020-03-05

Application:

Titus (specifically titus-control-plane)

CVE ID

CVE-2020-9297

Source:

https://github.com/Netflix/titus-control-plane

Severity:

High

Overview:

The GitHub Security Labs team (@pwntester) identified a security vulnerability in Netflix Titus. The vulnerability discovered allows an attacker to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability.

Impact:

This issue may lead to Remote Code Execution.

Description:

Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passed to ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument, they will be able to run arbitrary Java code.

The Fix

Titus has been patched as of 5 Mar 2020. The fix sanitizes the message string so it is not an EL expression by escaping special characters.

Patch:

Users of Titus should adopt the patched version of Titus. (>=v0.1.1-rc.274) Netflix/titus-control-plane#795