Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN631
_____________________________________________________________________

DATE                : 22/09/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Jinjava versions prior
                                     to 2.8.1.

=====================================================================
https://github.com/HubSpot/jinjava/security/advisories/GHSA-m49c-g9wr-hv6v
_____________________________________________________________________

Sandbox Bypass via JavaType-Based Deserialization
Critical
jasmith-hs published GHSA-m49c-g9wr-hv6v Sep 17, 2025

Package
com.hubspot.jinjava:jinjava (Maven)

Affected versions
< 2.8.1

Patched versions
2.8.1


Description

Summary

jinjava’s current sandbox restrictions prevent direct access to
dangerous methods such as getClass(), and block instantiation
of Class objects. However, these protections can be bypassed.

By using mapper.getTypeFactory().constructFromCanonical(), it
is possible to instruct the underlying ObjectMapper to
deserialize attacker-controlled input into arbitrary classes.
This enables the creation of semi-arbitrary class instances
without directly invoking restricted methods or class literals.

As a result, an attacker can escape the sandbox and instantiate
classes such as java.net.URL, opening up the ability to access
local files and URLs(e.g., file:///etc/passwd). With further
chaining, this primitive can potentially lead to remote code
execution (RCE).


Details

jinjava templates expose a built-in variable
____int3rpr3t3r____, which provides direct access to the
jinjavaInterpreter instance.

This variable was previously abused and protections were added
to prevent call method from JinjavaInterpreter instances (see
Add interpreter to blacklist).

However, interacting with the properties of JinjavaInterpreter
instances remains unrestricted.

From ____int3rpr3t3r____, it is possible to traverse to the
config field, which exposes an ObjectMapper. By invoking
readValue(String content, JavaType valueType) on this ObjectMapper,
an attacker can instantiate arbitrary classes specified via
JavaType.

Although jinjava explicitly restricts dangerous classes such
as Class, ClassLoader, and so on inside JinjavaBeanELResolver,
the JavaType class itself is not restricted.

As a result, an attacker can leverage JavaType construction
(constructFromCanonical) to instantiate semi-arbitrary classe
without directly calling restricted methods.

This allows sandbox escape and the creation of powerful
primitives.


Impact

Escape the Jinjava sandbox and instantiate a wide range of
classes using JavaType.

This capability can be used to read arbitrary files and to
perform full read SSRF by creating network-related objects.

In certain environments, depending on the available classes,
this primitive can even lead to complete remote code execution.


Severity
Critical
9.8/ 10

CVSS v3 base metrics
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE ID
CVE-2025-59340

Weaknesses
Weakness CWE-1336

Credits

    @taisehub taisehub Reporter
    @odgrso odgrso Reporter


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================