A Server-Side Template Injection (SSTI) vulnerability was discovered in the io.quarkus.qute.ReflectionValueResolver component of the Quarkus Qute template engine. The engine implements a security filter intended to prevent access to sensitive methods declared on java.lang.Object. However, this filter can be bypassed by navigating through methods declared on other classes that return a java.lang.Class object.
Specifically, an attacker can use Enum.getDeclaringClass() on any Enum instance present in the template context to obtain a Class object. Because the security filter only checks if a method is declared on Object.class, it permits calls to methods on the Class instance such as getClassLoader(). This allows an attacker to construct a reflection chain (e.g., enum.declaringClass.classLoader.loadClass('java.lang.Runtime').getMethod('getRuntime').invoke(null).exec('...')) to achieve arbitrary remote code execution (RCE) in the context of the Java process.
A Server-Side Template Injection (SSTI) vulnerability was discovered in the
io.quarkus.qute.ReflectionValueResolvercomponent of the Quarkus Qute template engine. The engine implements a security filter intended to prevent access to sensitive methods declared on java.lang.Object. However, this filter can be bypassed by navigating through methods declared on other classes that return a java.lang.Class object.Specifically, an attacker can use Enum.getDeclaringClass() on any Enum instance present in the template context to obtain a Class object. Because the security filter only checks if a method is declared on Object.class, it permits calls to methods on the Class instance such as getClassLoader(). This allows an attacker to construct a reflection chain (e.g., enum.declaringClass.classLoader.loadClass('java.lang.Runtime').getMethod('getRuntime').invoke(null).exec('...')) to achieve arbitrary remote code execution (RCE) in the context of the Java process.