CVE-2020-1959: 
Java vulnerability analysis and mitigation

A Server-Side Template Injection vulnerability was identified in Apache Syncope (CVE-2020-1959) enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution (RCE) vulnerability. The vulnerability was discovered in February 2020 and disclosed in May 2020, affecting Apache Syncope version 2.1.5 and prior versions (GitHub Security Lab, Apache Syncope Security).

The vulnerability exists in Apache Syncope's use of Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, they support different types of interpolation, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passed to ConstraintValidatorContext.buildConstraintViolationWithTemplate() argument, they can execute arbitrary Java code. There were 25 validators using this method, out of which 20 were found to be vulnerable by reflecting validated values in the error message (GitHub Security Lab).

The vulnerability allows unauthenticated attackers to execute arbitrary code on the server with Syncope service account privileges through the injection of Java Expression Language (EL) expressions (GitHub Security Lab).

The vulnerability was rated as Important severity and could be exploited by injecting arbitrary Java EL expressions into error message templates, leading to remote code execution capabilities (Apache Syncope Security).

The vulnerability was fixed in Apache Syncope version 2.1.6. Several remediation approaches were suggested: not including validated bean properties in custom error messages, sanitizing validated bean properties, disabling EL interpolation by using ParameterMessageInterpolator, or replacing Hibernate-Validator with Apache BVal (GitHub Security Lab).