Kingdee Cloud-Starry-Sky V8.2 Remote Code Execution Vulnerability (RCE) and Patch Details

Key Information Vulnerability Name: Kingdee Cloud-Starry-Sky Enterprise Edition V8.2 Remote Arbitrary Code Execution Vulnerability (RCE) Description: - The vulnerability allows attackers to inject malicious code into Kingdee Cloud Star BBC Mail (Tomcat+JBoss) and exploit the template engine's rendering mechanism to remotely execute arbitrary code without authentication. - Attackers can gain security privileges on the Kingdee Cloud Star server, steal sensitive data, take control of the central system, and perform deep intrusion and penetration attacks. Severity Level: Critical Remediation Plan: - Avoid template concatenation that accepts user input data. - Upgrade to version 2.3.17. The official patch provides three TemplateClassResolver options for class resolution: - UNRESTRICTED_RESOLVER: Allows obtaining any class via ClassUtil.forName(classNames). - SAFER_RESOLVER: Cannot load three template classes from freemarker.template.util.JythonRuntime. - ALLOWED_PKG_NAMES_RESOLVER: Only resolves classes within specified packages. - Directly use the configuration asNewBuiltinClassResolver to set it to SAFER_RESOLVER or ALLOWED_PKG_NAMES_RESOLVER. For dangerous built-in function APIs (disabled by default since version 2.3.22), avoid using configuration.setAPIBuiltinEnabled(true), and enable only the APIs that are required. Source: https://we.mail.qq.com/d/a/le-EjewVUdIneHRE2SfE Submitter: Anonymous (ID: 44066) Submission Date: May 2, 2020

Goal Reached Thanks to every supporter — we hit 100%!

Kingdee Cloud-Starry-Sky V8.2 Remote Code Execution Vulnerability (RCE) and Patch Details