Java Template Service

An intentionally vulnerable microservice for the CoronaScan remediation lab. It applies Apache Commons Text interpolation to user-provided templates. Never deploy it to a real environment.

Deliberate finding

• Dependency: org.apache.commons:commons-text
• Installed version: 1.9
• Finding: CVE-2022-42889
• Affected API: StringSubstitutor.createInterpolator()
• Fixed version: 1.10.0
• Reachability: POST /render passes the request body to the interpolator

Apache also recommends validating and sanitizing untrusted templates rather than relying only on the safer library defaults introduced in 1.10.0.

Build and test

docker build -t coronascan/java-template-service:vulnerable .

The Docker build runs the Maven unit tests before producing the runtime image.