skip to content
Back to
Home Bounties Research Advisories CodeQL Wall of Fame Get Involved Events
May 11, 2020

GHSL-2020-055: Server-Side Template Injection in Apache Syncope (RCE) - CVE-2019-17557

Alvaro Munoz


A Server-Side Template Injection in the Mail templates was identified in Apache Syncope enabling attackers to inject arbitrary JEXL expressions, leading to a Remote Code Execution (RCE) vulnerability.


Apache Syncope

Tested Version



Server-Side Template Injection on Mail templates (GHSL-2020-055, CVE-2019-1961)

Mail templates use JEXL expressions. Even though Syncope applies a Uberspector (org.apache.syncope.core.provisioning.api.jexl.ClassFreeUberspect) to prevent access to java.lang.Object.getClass and java.lang.Object.class, it is still possible to get a Class instance via other means. For example, an attacker could get a Class instance by accessing the TYPE field of boxed classes such as Integer, Long, Boolean, etc.



From there, an attacker could use Java reflection to instantiate arbitrary objects.

Note that since Core and EndUser are normally deployed with the same origin, a XSS issue allows an attacker to send such malicious requests by fooling the administrator into clicking a malicious link.


This issue may lead to Remote Code Execution


Use the Sandboxed Uberspector or customize a whitelist-based one.

This issue was addressed in the following commit


Coordinated Disclosure Timeline

This report was subject to the GHSL coordinated disclosure policy.



This issue was discovered and reported by GHSL team member @pwntester (Alvaro Muñoz).


You can contact the GHSL team at, please include the GHSL-2020-055 in any communication regarding this issue.