CVE-2020-12668: 
Java vulnerability analysis and mitigation

Jinjava before version 2.5.4 contained a security vulnerability (CVE-2020-12668) that allowed access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. The vulnerability was discovered in April 2020 and fixed in version 2.5.4 released in May 2020. The issue affected all versions of Jinjava prior to 2.5.4 (GitHub Security Lab).

The vulnerability existed because Jinjava did not properly restrict access to Class instances. While it prevented direct access to Class properties and methods returning Class instances, it failed to prevent Array or Map accesses that returned Class instances. Additionally, the internal Jinjava interpreter was exposed through a secret 'int3rpr3t3r' variable. This allowed access to template context variables, filters, functions, and tags. Through these functions, attackers could access java.lang.reflect.Method instances and subsequently obtain Class instances (GitHub Security Lab).

The vulnerability could allow for abuse of the application class loader, leading to arbitrary file disclosure. An attacker with privileges to write Jinjava templates, such as in a CMS context, could read arbitrary files from the file system. Additionally, the vulnerability could potentially be exploited for Server-Side Request Forgery (SSRF) attacks by using different protocols like http, https, or ftp to establish network connections (GitHub Security Lab).

The vulnerability required an attacker to have privileges to write Jinjava templates. Once this access was obtained, the attacker could exploit the vulnerability through a series of steps including accessing the interpreter, obtaining Class instances, and leveraging ClassLoader access to read arbitrary files (GitHub Security Lab).

The vulnerability was fixed in Jinjava version 2.5.4. The fix included adding Method and JinjavaInterpreter to the blacklist and implementing additional security measures to prevent unauthorized access to system resources. Users should upgrade to version 2.5.4 or later to mitigate this vulnerability (GitHub Release).