Summary
Floci versions 1.1.0 through before 2.2.0 contain a code injection vulnerability in the VtlTemplateEngine. An unauthenticated attacker who can create a REST API with a MOCK integration may abuse unrestricted Velocity templates to execute operating-system commands in the Floci JVM.
Floci versions 1.1.0 through before 2.2.0 contain a code injection vulnerability in the VtlTemplateEngine. An unauthenticated attacker who can create a REST API with a MOCK integration may abuse unrestricted Velocity templates to execute operating-system commands in the Floci JVM.
Affected context
The vulnerability occurs in Floci deployments that expose functionality for creating REST APIs and configuring MOCK integrations. It becomes risky when user-controlled or insufficiently restricted Velocity mapping templates are evaluated by the VtlTemplateEngine with access to reflective Java capabilities such as Runtime or ProcessBuilder.
The vulnerability occurs in Floci deployments that expose functionality for creating REST APIs and configuring MOCK integrations. It becomes risky when user-controlled or insufficiently restricted Velocity mapping templates are evaluated by the VtlTemplateEngine with access to reflective Java capabilities such as Runtime or ProcessBuilder.
Exploit preconditions
- Attack surface: REST API and MOCK integration configuration
- Required access: No authentication, where the affected API-creation functionality is publicly reachable
- Trigger point: Evaluation of a user-controlled Velocity mapping template
- Why exploitation is possible: The template environment permits unrestricted access to Java reflection or process-launching classes, allowing template expressions to cross from data transformation into command execution
- Attack surface: REST API and MOCK integration configuration
- Required access: No authentication, where the affected API-creation functionality is publicly reachable
- Trigger point: Evaluation of a user-controlled Velocity mapping template
- Why exploitation is possible: The template environment permits unrestricted access to Java reflection or process-launching classes, allowing template expressions to cross from data transformation into command execution
Why this happens
The underlying flaw is the evaluation of unrestricted template expressions in a context that exposes powerful Java objects and reflection mechanisms. Rather than limiting templates to data transformation operations, the engine permits access to capabilities that can start operating-system processes. This behavior maps to CWE-94: Improper Control of Generation of Code, because attacker-influenced template content is interpreted as executable logic.
The underlying flaw is the evaluation of unrestricted template expressions in a context that exposes powerful Java objects and reflection mechanisms. Rather than limiting templates to data transformation operations, the engine permits access to capabilities that can start operating-system processes. This behavior maps to CWE-94: Improper Control of Generation of Code, because attacker-influenced template content is interpreted as executable logic.
Potential impact
- Attackers may execute arbitrary operating-system commands in the Floci JVM process
- The application environment could be compromised
- Sensitive files, credentials, or configuration data may be accessed
- Attackers could alter application behavior or tamper with hosted API responses
- The compromised process may be used for lateral movement, depending on its privileges and network access
- Attackers may execute arbitrary operating-system commands in the Floci JVM process
- The application environment could be compromised
- Sensitive files, credentials, or configuration data may be accessed
- Attackers could alter application behavior or tamper with hosted API responses
- The compromised process may be used for lateral movement, depending on its privileges and network access
General mitigation guidance
Mitigation generally focuses on removing executable capabilities from template processing and reducing trust in template definitions.
Common defensive patterns include:
- Restricting templates to an allowlisted, non-executable expression subset
- Disabling reflection, class access, and process-launching functionality in the template context
- Separating API definition from template execution and applying strict schema validation
- Requiring authentication and authorization for API and integration creation
- Running Floci with least-privilege operating-system and network permissions
- Avoiding sensitive credentials and broad filesystem access in the JVM environment
- Applying sandboxing or isolated worker boundaries where template execution is unavoidable
Mitigation generally focuses on removing executable capabilities from template processing and reducing trust in template definitions.
Common defensive patterns include:
- Restricting templates to an allowlisted, non-executable expression subset
- Disabling reflection, class access, and process-launching functionality in the template context
- Separating API definition from template execution and applying strict schema validation
- Requiring authentication and authorization for API and integration creation
- Running Floci with least-privilege operating-system and network permissions
- Avoiding sensitive credentials and broad filesystem access in the JVM environment
- Applying sandboxing or isolated worker boundaries where template execution is unavoidable
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis and code review rules targeting unrestricted Velocity evaluation and reflective class access
- Review signals showing template engines exposed to request-controlled or administrator-controlled content without capability restrictions
- Tests that verify templates cannot access class loaders, reflection APIs, process builders, or runtime execution interfaces
- Runtime monitoring for unexpected child processes, shell invocations, or unusual outbound connections from the Floci JVM
- Policy enforcement requiring authentication and approval for REST API and MOCK integration creation
- Automated security review tools that flag template evaluation with dangerous object exposure
Organizations can look for this class of issue through:
- Static analysis and code review rules targeting unrestricted Velocity evaluation and reflective class access
- Review signals showing template engines exposed to request-controlled or administrator-controlled content without capability restrictions
- Tests that verify templates cannot access class loaders, reflection APIs, process builders, or runtime execution interfaces
- Runtime monitoring for unexpected child processes, shell invocations, or unusual outbound connections from the Floci JVM
- Policy enforcement requiring authentication and approval for REST API and MOCK integration creation
- Automated security review tools that flag template evaluation with dangerous object exposure
