Room for Escape: Scribbling Outside the Lines of Template Security

The presentation discusses the vulnerabilities in content management systems (CMS) and their template systems, focusing on .NET-based systems like SharePoint and Java-based systems. The goal is to escape the sandboxes and run arbitrary system commands on the underlying servers.

• Content management systems (CMS) use templates to render dynamic content, which are a mix of static and dynamic content
• The dynamic parts of templates are evaluated using programming language capabilities, which can lead to remote code execution
• The presentation focuses on .NET-based systems like SharePoint and Java-based systems
• The researchers were able to break the SharePoint sandbox in five different ways
• The presentation reviews 10 different content management systems and up to four different template engines, including popular ones like FreeMarker and Velocity
• The goal is to escape the sandboxes and run arbitrary system commands on the underlying servers

The researchers were able to craft a payload that fooled the page filter in SharePoint into allowing unsafe markup, which allowed them to use the object data source control to pop up a calculator. They were able to achieve remote code execution on multiple CMS platforms.

Now more than ever, digital communication and collaboration are essential to the modern human experience. People around the globe work together online as they share information, create documents, send emails, and collaborate on spreadsheets and presentations. Shared digital content is everywhere and networked communication platforms and software play a crucial role. Content Management Systems (CMS) allow the user to design, create, modify, and visualize dynamic content. For many companies, CMS platforms are pivotal to their content pipelines and workforce collaboration.In our research, we discovered multiple ways to achieve Remote Code Execution (RCE) on CMS platforms where users can create or modify templates for dynamic content. In today's multi-tenancy ecosystems, this often implies that a co-tenant on the same system can take over control of the CMS resources on which your organization relies.Using a Microsoft SharePoint server as our main CMS attack surface, we combined flaws in its implementation and design with framework and language specific features to find six unique RCE vulnerabilities. In addition, we reviewed some of the most popular Java Template engines such as Apache Velocity, Apache FreeMarker, Pebble, and JinJava. As a result of this effort, we discovered ways to escape template sandboxes and achieve RCE in many products including: Atlassian Confluence, Alfresco, Liferay, Crafter CMS, dotCMS, XWiki, Apache OfBiz, and more.We will analyze how these products and frameworks implement security controls and review the various techniques that we used to bypass them. We will describe all the vulnerabilities we uncovered in detail and show working demos of the most interesting attacks where unprivileged users can run arbitrary commands on SharePoint or Liferay servers.Finally, we will present our general review methodologies for systems with dynamic content templates and provide practical recommendations to better protect them.