GHSA-83m8-7hj8-ff5w

Pebble Templates Improper Input Validation vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-19899

Packages

Ecosystem	Package	Affected	Fixed in
Maven	io.pebbletemplates:pebble-project	< 3.1.4	3.1.4

Details

As written in the advisory (Markdown source, shown as plain text).

Pebble Templates prior to 3.1.4 allows attackers to bypass a protection mechanism (intended to block access to instances of java.lang.Class) because getClass is accessible via the public static java.lang.Class `java.lang.Class.forName(java.lang.Module,java.lang.String)` signature.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-19899 advisory
https://github.com/PebbleTemplates/pebble/issues/493 web
https://github.com/PebbleTemplates/pebble/pull/511 web
https://github.com/PebbleTemplates/pebble package
https://research.securitum.com/server-side-template-injection-on-the-example-of-pebble web