CVE-2025-64087
📋 TL;DR
A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport allows attackers to execute arbitrary code by injecting malicious template expressions. This affects applications using XDocReport versions 1.0.0 through 2.1.0 for document generation. Attackers can achieve remote code execution with the privileges of the application server.
💻 Affected Systems
- opensagres XDocReport
📦 What is this software?
Xdocreport by Opensagres
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the server, data exfiltration, lateral movement, and persistent backdoor installation.
Likely Case
Remote code execution leading to data theft, service disruption, and potential ransomware deployment.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially only causing denial of service.
🎯 Exploit Status
Public proof-of-concept code is available. Exploitation requires the ability to inject template expressions into FreeMarker templates processed by XDocReport.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.1.1 or later
Vendor Advisory: https://github.com/opensagres/xdocreport/pull/705
Restart Required: Yes
Instructions:
1. Update XDocReport dependency to version 2.1.1 or later. 2. Update pom.xml or build.gradle to reference the patched version. 3. Rebuild and redeploy the application. 4. Restart the application server.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation to reject any template expressions containing potentially dangerous characters or patterns.
FreeMarker Sandbox Configuration
allConfigure FreeMarker with restricted template loading and execution sandbox to limit template capabilities.
ConfigurationBean cfg = new ConfigurationBean();
cfg.setTemplateExceptionHandler(TemplateExceptionHandler.RETHROW_HANDLER);
cfg.setNewBuiltinClassResolver(TemplateClassResolver.SAFER_RESOLVER);
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block SSTI payloads targeting FreeMarker templates.
- Isolate the vulnerable application in a network segment with strict outbound traffic controls and monitor for suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Check if your application uses XDocReport version 1.0.0 through 2.1.0 by examining dependency files (pom.xml, build.gradle) or running 'mvn dependency:tree' or 'gradle dependencies'.Check Version:
mvn dependency:tree | grep xdocreport OR gradle dependencies | grep xdocreportVerify Fix Applied:
Verify that XDocReport version is 2.1.1 or higher in your dependency management files and that the application has been rebuilt and redeployed.📡 Detection & Monitoring
Log Indicators:
- Unusual template processing errors
- FreeMarker exceptions containing user input
- Unexpected system command execution in logs
- Outbound connections from application server to unknown IPs
Network Indicators:
- HTTP requests containing FreeMarker template expressions in parameters
- Unusual outbound traffic patterns from the application server
SIEM Query:
source="application.logs" AND ("freemarker.template" OR "xdocreport") AND ("exec" OR "Runtime.getRuntime" OR "ProcessBuilder")