Loading story…
A penetration test found that an administrator-editable password reset email template in a Java-based application was vulnerable to server-side template injection (SSTI), allowing attacker-supplied expressions such as ${7*7} to be evaluated on the server. Further testing showed the template engine exposed access to Java classes, reflection, system properties, and environment variables on the underlying Windows host, turning a routine customization feature into a path for deeper server compromise.
The testers escalated the flaw to remote code execution by invoking Java runtime methods from the template context and verified execution through a Burp Collaborator DNS callback; they also retrieved command output directly and observed whoami returning nt authority\local service. The findings align with established SSTI research showing that unsafe template rendering can expose application internals and enable arbitrary code execution when template restrictions, input validation, and runtime sandboxing are inadequate.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
PortSwigger published research on server-side template injection, establishing the vulnerability class referenced by later work. The reference identifies this publication date explicitly.
The testers invoked `java.lang.Runtime.getRuntime().exec()` through the template injection flaw and confirmed command execution with a Burp Collaborator DNS interaction. They also retrieved direct command output with a Java Scanner payload, with `whoami` returning `nt authority\local service`.
Further probing with payloads such as `${''.getClass()}` and `forName('java.lang.System')` exposed Java reflection and allowed retrieval of system properties and environment variables, revealing the server was running on Windows. This demonstrated that the template engine exposed sensitive runtime access beyond simple expression evaluation.
During a penetration test, testers found that an administrator-editable password reset email template evaluated `${7*7}` as `49`, confirming server-side template injection in a Java-based application used for document distribution and communications. The content does not explicitly anchor when the test occurred.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical flaw tracked as **`CVE-2026-40478`** allows attackers to bypass Thymeleaf’s expression-injection protections and achieve **server-side template injection (SSTI)** in applications that pass unvalidated user input into the template engine. The vulnerability affects **Thymeleaf 3.1.3.RELEASE and earlier** and stems from improper neutralization of syntax patterns in expression execution, including a whitespace parsing mismatch that let attackers evade detection of the SpEL `new` keyword and an incomplete type blocklist that still allowed dangerous class instantiation. The issue is mapped to **`CWE-917`** and **`CWE-1336`**, with a published **CVSS v3.1** vector of **`AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H`**. Researchers said successful exploitation can enable arbitrary file writes and potentially remote code execution in **Spring-based Java applications**, where Thymeleaf is commonly used as the default template engine in Spring Boot. The flaw can be exploited remotely without authentication when attacker-controlled input reaches Thymeleaf expression parsing, view names, or fragment selectors. The issue is addressed in **`3.1.4.RELEASE`**, which normalizes whitespace before checks, expands external-access detection, restricts dangerous expression objects, and tightens type restrictions; defenders are urged to upgrade **`thymeleaf`**, **`thymeleaf-spring5`**, and **`thymeleaf-spring6`** and review applications to ensure untrusted input is never interpreted as template expressions.
Jun 29, 2026
Oracle E-Business Suite was recently found to be vulnerable to a critical security flaw, CVE-2025-61882, which has been actively exploited in the wild. Oracle published a security bulletin disclosing the vulnerability, providing a patch, and sharing indicators of compromise observed during incident response. Attackers leveraged a Python-based exploit script, referred to as 'exp.py', which automates the exploitation process by interacting with specific endpoints in Oracle E-Business Suite. The script initiates by sending a GET request to '/OA_HTML/runforms.jsp' to determine the internal host, followed by a POST request to '/OA_HTML/JavaScriptServlet' to retrieve a CSRF token required for further exploitation. The final exploit request is sent to '/OA_HTML/configurator/UiServlet', with a crafted payload designed to trigger the vulnerability. Analysis of attack logs reveals that the initial exploitation is followed by the dropping of malicious template files onto the target system. These templates are then activated by previewing them, which triggers further malicious activity. Apache logs from compromised systems show a sequence of GET and POST requests to endpoints such as '/OA_HTML/OA.jsp?page=/oracle/apps/xdo/oa/template/webui/TemplateCopyPG' and '/OA_HTML/OA.jsp?page=/oracle/apps/xdo/oa/template/webui/TemplateFileAddPG', indicating the deployment and activation of these templates. Two distinct types of malicious templates have been identified. The first type contacts a hardcoded command-and-control (C2) IP address and executes arbitrary Java code within the context of the Oracle WebLogic server, allowing attackers to maintain persistence without dropping additional files to disk. This template retrieves the HTTP response object, sends data back to the attacker, and establishes a connection to the C2 server using a custom protocol string, then loads and executes a Java class received from the C2 server after decrypting it. The second template type embeds a Java class file directly within the template, which is decoded and executed upon activation. This template installs a backdoor that enables attackers to send specially crafted POST requests to a specific endpoint ('/support/state/content/destination./navId.1/navvSetId.iHelp/') to execute arbitrary Java code remotely. Both template types use base64 encoding to obfuscate their payloads, which are decoded and executed in memory, making detection and forensic analysis more challenging. The exploitation chain demonstrates a sophisticated understanding of Oracle E-Business Suite internals and leverages multiple stages to achieve code execution and persistence. Oracle's response included the release of a patch and detailed indicators of compromise, such as specific HTTP request patterns and file artifacts, to aid defenders in identifying affected systems. Security researchers have provided in-depth technical analyses of the exploit script and the malicious templates, highlighting the importance of monitoring for unusual template file activity and suspicious HTTP requests in Oracle E-Business Suite environments. The attack underscores the critical need for organizations to apply security patches promptly and to monitor for signs of exploitation, especially in widely deployed enterprise applications like Oracle E-Business Suite. The use of in-memory execution and custom C2 protocols further complicates detection and response efforts. Organizations are advised to review Oracle's security bulletin, apply the provided patch, and search for the published indicators of compromise to ensure their environments are not affected by this active threat.
Jun 29, 2026
A critical **server-side template injection** flaw tracked as `CVE-2026-54390` affects **JTL Shop** versions **5.2.0 through 5.7.1**, where unsanitized user input is passed to the **Smarty** template engine. The vulnerability allows **unauthenticated remote attackers** to inject malicious template syntax and access sensitive server-side information, including **database credentials** and **encryption keys**. On **JTL Shop 5.4.0 through 5.7.1**, the flaw can be escalated to **remote code execution** by abusing registered Smarty modifiers such as `unserialize` and `file_get_contents` to write a **webshell** into the web root and run arbitrary commands as the web server user. The issue has been rated **critical** with **CVSS 3.1 9.8** and **CVSS 4.0 9.3**, and affected organizations are advised to upgrade to **JTL Shop 5.7.2 or later** and ensure user input reaching the template engine is properly sanitized.
Jun 29, 2026