Vulnerability · Published Aug 16, 2021 · Assigned by GitHub_M

CVE-2021-32827Arbitrary code execution in MockServer

Medium 6.1

In plain English

A medium-severity injection in mockserver from mock-server. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)2.2%top 17.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

MockServer is open source software which enables easy mocking of any system you integrate with via HTTP or HTTPS. An attacker that can trick a victim into visiting a malicious site while running MockServer locally, will be able to run arbitrary code on the MockServer machine. With an overly broad default CORS configuration MockServer allows any site to send cross-site requests. Additionally, MockServer allows you to create dynamic expectations using Javascript or Velocity templates. Both engines may allow an attacker to execute arbitrary code on-behalf of MockServer. By combining these two issues (Overly broad CORS configuration + Script injection), an attacker could serve a malicious page so that if a developer running MockServer visits it, they will get compromised. For more details including a PoC see the referenced GHSL-2021-059.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.mock-server:mockserver	no fix listed	GHSA-v3cg-h3f6-2242

Affected products (as reported)

Vendor	Product	Versions
mock-server	mockserver	all

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

References

https://securitylab.github.com/advisories/GHSL-2021-059-mockserver/ x_refsource_CONFIRM
https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC