Apache Syncope Improper Isolation Vulnerability Leading to Post-Authentication Remote Code Execution

A vulnerability allowing post-authentication remote code execution has been identified in Apache Syncope versions 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0. This issue arises from improper isolation or compartmentalization, enabling an administrator with the right entitlements to create a malicious Groovy class. The untrusted code can bypass sandboxing and execute through the class's static initializer.

Impact

Exploitation of this vulnerability allows for post-authentication remote code execution on the server where Apache Syncope is running.

Remediation

Users are advised to upgrade to Apache Syncope versions 4.0.6 or 4.1.1, which address this vulnerability by ensuring that even static initializers in Groovy code are executed in a sandboxed environment.