CVE-2021-31635
📋 TL;DR
CVE-2021-31635 is a Server-Side Template Injection vulnerability in jFinal framework that allows remote attackers to execute arbitrary code by manipulating template functions. This affects all applications using vulnerable versions of jFinal. Attackers can achieve remote code execution with potentially devastating consequences.
💻 Affected Systems
- jFinal Java Web Framework
📦 What is this software?
Jfinal by Jfinal
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the server, data exfiltration, lateral movement, and persistent backdoor installation.
Likely Case
Remote code execution leading to web application compromise, data theft, and potential pivot to internal network resources.
If Mitigated
Attack blocked at WAF level or prevented by input validation, resulting in no impact.
🎯 Exploit Status
SSTI vulnerabilities in Java frameworks are commonly exploited with publicly available payloads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: jFinal 4.9.09 and later
Vendor Advisory: https://github.com/jfinal/jfinal/issues/187
Restart Required: Yes
Instructions:
1. Update jFinal dependency to version 4.9.09 or later in your pom.xml or build.gradle. 2. Rebuild and redeploy your application. 3. Restart the application server.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation and sanitization for all user-controlled template parameters
WAF Rule Implementation
allDeploy web application firewall rules to detect and block SSTI payloads
🧯 If You Can't Patch
- Implement strict input validation to reject any template syntax in user inputs
- Deploy network segmentation and restrict access to vulnerable applications
🔍 How to Verify
Check if Vulnerable:
Check your project's dependency management file (pom.xml, build.gradle) for jFinal version 4.9.08 or earlierCheck Version:
grep -i jfinal pom.xml || grep -i jfinal build.gradle || check Maven/Gradle dependency treeVerify Fix Applied:
Verify jFinal version is 4.9.09 or later in your dependencies and test template functionality with safe inputs📡 Detection & Monitoring
Log Indicators:
- Unusual template rendering errors
- Java class loading from unexpected sources
- Suspicious template expressions in request parameters
Network Indicators:
- HTTP requests containing template syntax like ${, #{, or <% in parameters
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND ("${*" OR "#{" OR "<%" OR "%>" OR "@Runtime" OR "@ProcessBuilder")