Skip to content
Permalink
master
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Go to file
 
 
Cannot retrieve contributors at this time
Advisory ID:

NFLX-2020-002

Advisory Title:

Server-Side Template Injection in Netflix Titus

Author:

Aladdin Almubayed / amubaied@netflix.com

Release Date:

2020-03-05

Application:

Titus (specifically titus-control-plane)

CVE ID

CVE-2020-9297

Source:

https://github.com/Netflix/titus-control-plane

Severity:

High

Overview:

The GitHub Security Labs team (@pwntester) identified a security vulnerability in Netflix Titus. The vulnerability discovered allows an attacker to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability.

Impact:

This issue may lead to Remote Code Execution.

Description:

Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passed to ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument, they will be able to run arbitrary Java code.

The Fix

Titus has been patched as of 5 Mar 2020. The fix sanitizes the message string so it is not an EL expression by escaping special characters.

Patch:

Users of Titus should adopt the patched version of Titus. (>=v0.1.1-rc.274) Netflix/titus-control-plane#795