CVE-2022-24881 Command Injection in Ballcat Codegen
Attackers can achieve remote code execution by injecting malicious code into templates due to insufficient input validation in the Ballcat Codegen library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24881?
CVE-2022-24881 is a high-severity code injection vulnerability in ballcat-projects ballcat-codegen, published on 26 Apr 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, attackers can implement remote code execution through malicious code injection of the template engine. This happens because Velocity and freemarker templates are introduced but input verification is not done. The fault is rectified in version 1.0.0.beta.2.
Which versions are affected by CVE-2022-24881?
2 open source packages ship an affected version, including com.hccake:ballcat-codegen. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.hccake:ballcat-codegen Maven | All versions | 1.0.0.beta.2 |
com.hccake:ballcat-codegen Maven | All versions | 1.0.0.beta.2 |
Products include Ballcat Codegen.
How do I fix CVE-2022-24881?
Upgrade com.hccake:ballcat-codegen to 1.0.0.beta.2 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-24881 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-24881 exists.
Sources
Also known as GHSA-fv3m-xhqw-9m79.