Vulnerability · Published Apr 26, 2022 · Assigned by GitHub_M

CVE-2022-24881Command Injection in Ballcat Codegen

High 8.8

In plain English

A high-severity code injection in ballcat-codegen from ballcat-projects. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.2% (higher than 88% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)3.2%top 11.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, attackers can implement remote code execution through malicious code injection of the template engine. This happens because Velocity and freemarker templates are introduced but input verification is not done. The fault is rectified in version 1.0.0.beta.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	com.hccake:ballcat-codegen	1.0.0.beta.2	GHSA-fv3m-xhqw-9m79

Affected products (as reported)

Vendor	Product	Versions
ballcat-projects	ballcat-codegen	< 1.0.0.beta.2

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/ballcat-projects/ballcat-codegen/security/advisories/GHSA-fv3m-xhqw-9m79 x_refsource_CONFIRM
https://github.com/ballcat-projects/ballcat-codegen/issues/5 x_refsource_MISC
https://github.com/ballcat-projects/ballcat-codegen/commit/84a7cb38daf0295b93aba21d562ec627e4eb463b x_refsource_MISC