An issue was discovered in FusionAuth before 1.11.0. An authenticated user, allowed to edit e-mail templates (Home -> Settings -> Email Templates) or themes (Home -> Settings -> Themes), can execute commands on the underlying operating system by abusing freemarker.template.utility.Execute in the Apache FreeMarker engine that processes custom templates.
amdefine 1.0.0, amdefine 1.0.1, ANTLR 3.0ea8, ASM 4.1, ASM 5.0.2, babel-regenerator-runtime 6.2.0, babel-regenerator-runtime 6.5.0, bcrypt-pbkdf 1.0.1, blockenspiel 0.5.0, boom 0.4.2, boom 2.10.1, burrito 0.2.12, Buster.JS 1.1.2, caseless 0.6.0, caseless 0.8.0, caseless 0.9.0, charenc 0.0.1, chmodr 0.1.0, CoffeeScriptRedux 2.0.0-beta4, configstore 0.3.2, crypt 0.0.1, cryptiles 0.2.2, cryptiles 2.0.5, cryptocoin-ripemd160 0.2.0, cryptocoin-ripemd160 1.0.1, css-what 1.0.0, css-what 2.1.0, CSSselect 0.4.1, CSSselect 1.0.0, CSSselect 1.2.0, d2-ui 0.0.18-alpha-0, d2-ui 24.1.13, d2-ui 24.1.17, d2-ui 25.0.2, d2-ui 25.0.4, d3-array 0.7.1, d3-array 0.8.1, d3-array 1.0.1, d3-array 1.0.2, d3-collection 0.1.0, d3-collection 0.3.0, d3-collection 1.0.1, d3-collection 1.0.2, d3-color 0.3.3, d3-color 0.5.0, d3-color 1.0.2, d3-format 1.0.0, d3-format 1.0.1, d3-format 1.0.2, d3-interpolate 1.1.0, d3-interpolate 1.1.1, d3-interpolate 1.1.3, d3-path 0.1.2, d3-path 0.2.0, d3-path 1.0.2, d3-path 1.0.3, d3-scale 0.9.0, d3-scale 1.0.3, d3-scale 1.0.4, d3-shape 0.5.0, d3-shape 0.7.0, d3-shape v1.0.3, d3-shape v1.0.4, d3-time 0.3.0, d3-time 0.3.1, d3-time 1.0.4, d3-time-format 1.1.0, d3-time-format 2.0.1, d3-time-format 2.0.2, d3-time-format 2.0.3, dhis2 2.10, diff 1.4.0, diff 2.2.2, diff 2.2.3, dnsjava 2.1.0, doctrine 0.7.2, dom4j: flexible XML framework for Java 1.6.1, duplexer2.jbenet 0.0.2, duplexer2.jbenet 0.1.4, escodegen 0.0.23, escodegen 0.0.28, escodegen 1.0.1, escope 1.0.3, Esprima 2.7.2, esprima-fb 15001.1001.0-dev-harmony-fb, esquery 0.4.0, esquery 1.0.0, estraverse 1.9.3, estraverse 2.0.0, esutils 1.1.6, esutils 2.0.2, Facebook Flux 3.0.0, fbemitter 2.0.0, fbemitter 2.0.2, fbemitter 2.1.1, fbjs 0.1.0-alpha.7, fbjs 0.2.1, fbjs 0.3.2, fbjs 0.6.1, fbjs 0.8.12, fbjs 0.8.4, fbjs 0.8.5, fbjs 0.8.6, fbjs 0.8.9, ffi 1.9.10, ffi 1.9.14, ffi 1.9.18, flux 2.0.3, flux 2.1.1, fork-stream 0.0.4, formatio 1.1.1, FreeMarker 2.3.9, Google.ProtocolBuffers 2.4.1.473, hawk 1.1.1, hawk 2.3.1, hawk v3.1.3, highlight.js 8.9.1, hoek 0.9.1, hoek 2.16.3, ibrik 1.0.1, ieee754 1.1.8, immutable-js 3.8.1, insight 1.0.0, insight v0.4.3, interpret v1.0.1, invariant 2.1.2, invariant 2.2.0, invariant 2.2.1, invariant 2.2.2, istanbul-js 0.1.46, istanbul-lib-coverage 1.0.0, istanbul-lib-hook 1.0.0, istanbul-lib-hook 1.0.0-alpha.4, istanbul-lib-instrument 1.1.0, istanbul-lib-report 1.0.0-alpha.3, istanbul-lib-source-maps 1.0.0, istanbul-lib-source-maps 1.0.0-alpha.10, istanbul-reports 1.0.0, istanbul-reports 1.0.0-alpha.7, istanbul-reports 1.0.0-alpha.8, jargs 1.0, jaxen 1.1-beta-6, jaxen 1.1.6, jedediah 0.1.1, js-base64 2.1.9, jsbn 0.1.0, json-schema 0.2.2, json-schema 0.2.3, lfs-theme 0.11.1, lolex 1.1.0, lolex 1.3.2, md5 2.2.1, mute-stream 0.0.4, node-graceful-fs 1.1.14, node-graceful-fs 1.2.3, node-pre-gyp 0.6.15, node-pre-gyp 0.6.19, node-pre-gyp 0.6.25, node-pre-gyp 0.6.26, node-pre-gyp 0.6.29, node-pre-gyp 0.6.32, Node.js 0.10.48, npmconf 0.0.24, npmlog 0.1.1, nth-check 1.0.1, once 1.1.1, once 1.2.0, once 1.3.1, osenv 0.0.3, osenv 0.1.0, owasp-esapi-java 2.0GA, phantomjs 1.9.6, PostgreSQL JDBC Driver 9.4-1208, public_suffix_service 0.5.20160826, public_suffix_service 0.5.20170404, qs 5.2.1, qs 6.0.2, qs 6.0.4, qs 6.1.0, qs 6.2.0, qs 6.2.1, qs 6.3.0, qs 6.3.2, qs 6.4.0, rc 1.1.6, react 15.4.1, React from Facebook 0.0.20150721210610, react-addons-css-transition-group 0.14.2, react-addons-css-transition-group 15.3.1, react-addons-css-transition-group 15.3.2, react-addons-css-transition-group 15.4.2, react-addons-linked-state-mixin 15.3.2, react-addons-pure-render-mixin 0.14.0, react-addons-pure-render-mixin 15.3.1, react-addons-pure-render-mixin 15.3.2, react-addons-shallow-compare 0.14.0, react-addons-shallow-compare 15.3.1, react-addons-shallow-compare 15.3.2, react-addons-shallow-compare 15.4.2, react-addons-test-utils 0.14.7, react-addons-test-utils 15.3.1, react-addons-test-utils 15.3.2, react-addons-test-utils 15.4.0, react-addons-test-utils 15.4.1, react-addons-test-utils 15.4.2, react-addons-transition-group 0.14.0, react-addons-transition-group 15.3.1, react-addons-transition-group 15.4.2, react-addons-update 15.3.1, readable-stream 1.0.17, redux-immutable 3.0.6, redux-immutable 3.0.8, reflections 0.9.10, regenerator 0.8.40, regenerator 0.9.1, regenerator 0.9.11, regenerator 0.9.8, regenerator 6.11.4, regenerator 6.16.1, regjsparser 0.1.5, replacestream 4.0.2, ruby-pg 0.19.0, shelljs 0.5.3, shelljs 0.6.0, shelljs 0.6.1, shelljs 0.7.7, shelljs 0.7.8, Sinon.JS 1.15.4, Sinon.JS 1.17.5, Sinon.JS 1.17.6, site_prism 2.9, sntp 0.2.4, sntp 1.0.9, sourcemap 0.1.32, sourcemap 0.1.43, sourcemap 0.2.0, sourcemap 0.4.4, sourcemap 0.5.3, sourcemap 0.5.5, sourcemap 0.5.6, sprintf.js 1.0.3, Stax2 API 3.1.4, stream-counter 0.2.0, stream-throttle 0.1.3, stringify-object 1.0.1, StringScanner 0.0.3, table 3.7.10, table 3.7.8, table 3.8.0, tough-cookie 2.2.1, tough-cookie 2.2.2, tough-cookie 2.3.1, tough-cookie 2.3.2, update-notifier 0.2.0, versionomy 0.5.0, warning 3.0.0, webcomponentsjs 0.6.1, XStream 1.3, YUI 2.3.0, YUI 2.4.0r2, yui 2.9.0.dfsg.0.1, YUI 3.2.0
Theme Lab – Templates 5.4.1 Crack Mac Osx
2ff7e9595c
Comments