DSpace GHSA-9x82-m84-c6x7 Velocity Template RCE (CVSS 8.0)

Summary of Key Vulnerability Information Vulnerability Overview Vulnerability Type: Remote Code Execution (RCE) Vulnerability ID: GHSA-9x82-m84-c6x7 Severity: High (CVSS 3.1 Score: 8.0/10) Affected Component: (Maven) Affected Versions: 8.0 <= 8.3, 9.0 <= 9.2 Fixed Versions: 8.4, 9.3, 10.0 Vulnerability Description: An RCE vulnerability exists in the Velocity templates used in DSpace for the LDN (Library Discovery Network). Exploitation of this vulnerability requires the attacker to have DSpace administrator credentials. This vulnerability is related to the path traversal attack identified in GHSA-3gmd-rh9w-p6ty and is part of a "proof of concept" attack chain. Scope of Impact When the LDN path traversal vulnerability is exploited, the attacker may be able to execute Java code directly (via the reflection mechanism). Disabling LDN removes all known attack paths. Velocity is also used for email templates, but no known attack paths exist for email templates. Remediation 1. Upgrade Versions: Upgrade to DSpace 8.4, 9.3, or 10.0. 2. Manual Patching (if immediate upgrade is not possible): - 9.x patch: Pull request #15248 (patch file available for download) - 8.x patch: Pull request #15249 (patch file available for download) 3. Applying the Patch to DSpace: - Download the patch file for the corresponding version - Apply the patch in the DSpace site root directory (e.g., ) - Recompile the DSpace backend code - Redeploy DSpace (e.g., ) - Restart Tomcat (or the runnable JAR) Interim Mitigation Measures Disable LDN in or (set ) Note: LDN is disabled by default; many DSpace sites may not be using this feature. After applying the patch or upgrading, LDN can be safely re-enabled. Reference Information This vulnerability is similar to a vulnerability reported by Velocity itself: - Velocity 2.2, CVE: https://www.cve.org/CVE2020-13936 - Fixed in Velocity 2.3, and DSpace already includes this fix. Contributors Discovery and Reporting: Pablo Picuril Ortiz (@supergeeks2703), a cybersecurity student at Universidad Rey Juan Carlos Code Development: Kim Shepherd (@kshepherd), Library Code

Goal Reached Thanks to every supporter — we hit 100%!

DSpace GHSA-9x82-m84-c6x7 Velocity Template RCE (CVSS 8.0)

More from this source