OneBlog Template Injection Vulnerability in Version 2.3.6 Allowing Code Execution

A template injection vulnerability has been identified in OneBlog version 2.3.6, specifically within the template management section. This issue arises from the 'spring-boot-starter-freemarker' component, which lacks proper rule restrictions, enabling arbitrary code execution.

Impact

Exploitation of this vulnerability allows for template injection, which can lead to arbitrary code execution on the server.

Reproduction

To reproduce this vulnerability, reference the 'spring-boot-starter-freemarker' component in the 'blog-core/pom.xml' file. In the template management section of the backend, locate the 'TM_SITEMAP_HTML' file and inject the proof of concept (POC) payload, which includes commands to execute, such as opening the calculator application or reading the '/etc/passwd' file. After saving the injection, the vulnerability can be triggered by accessing the sitemap.html file, either through the homepage or directly via the URL.