[<prev] [next>] [day] [month] [year] [list]
Message-ID: <b8cb0485-6dda-9bf6-9872-14e3c6cc0d7e@apache.org>
Date: Mon, 20 Oct 2025 13:14:49 +0000
From: Francesco Chicchiriccò <ilgrosso@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-57738: Apache Syncope: Remote Code Execution by delegated
administrators
Severity: moderate
Affected versions:
- Apache Syncope 2.1 through 2.1.14
- Apache Syncope 3.0 through 3.0.13
- Apache Syncope 4.0 through 4.0.1
Description:
Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter being particularly attractive as the machinery is set for runtime reload.
Such a feature has been available for a while, but recently it was discovered that a malicious administrator can inject Groovy code that can be executed remotely by a running Apache Syncope Core instance.
Users are recommended to upgrade to version 3.0.14 / 4.0.2, which fix this issue by forcing the Groovy code to run in a sandbox.
Credit:
Mike Cole (Mantel Group) (finder)
References:
https://syncope.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-57738
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
