Apache Syncope vulnerabilities

An Improper Isolation or Compartmentalization vulnerability in Apache Syncope allows an administrator with adequate entitlements to create a malicious Groovy class containing untrusted code, bypassing the Groovy security sandbox.

An improper privilege management vulnerability exists in Apache Syncope. A user can exploit a REST API call to grant themselves administrative roles, gaining full control over the system. Affected versions: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1.

An SQL Injection vulnerability in Apache Syncope allows an administrator with adequate entitlements to execute arbitrary SQL via stacked queries using unsanitized sort parameters. Affected versions: 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1.

An improper isolation or compartmentalization vulnerability exists in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution through the connector subsystem by relying on scripted connectors (REST and SQL) to run Groovy scripts.

A vulnerability in Apache Syncope allows improper isolation of Groovy scripts in BPMN processes. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and start them, causing the Groovy script to execute directly on the server without a sandbox.

An authenticated Server-Side Request Forgery (SSRF) vulnerability with low privileges was found in Apache Syncope via Connectors and Resources check. It allows an attacker to send requests from the server to internal systems.

Apache Syncope versions 3.0 to 3.0.16, 4.0 to 4.0.5, and 4.1.0 have a sensitive information disclosure vulnerability via malicious JEXL expressions in Derived Schemas. An administrator with sufficient entitlements can access user-related security-sensitive information.

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can create a malicious Groovy class containing untrusted code reaching a non-sandboxed execution path via the class static initializer. This affects versions 3.0 through 3.0.16, 4.0 through 4.0.5, and 4.1.0. Fixed in 4.0.6 and 4.1.1.