Template Injection in OpenBoxes

Executive Summary

This is a Server-Side Template Injection (SSTI) vulnerability in OpenBoxes, a supply chain management system used by healthcare and humanitarian organizations. The flaw exists in versions up to 0.9.6 and allows authenticated users to achieve Remote Code Execution (RCE) on the server. The vulnerability stems from improper neutralization of special elements in a template engine, specifically in the buildZebraTemplate function of DocumentController.groovy. The issue arises because the GroovyPagesTemplateEngine evaluates ${...} expressions as live Groovy code, enabling arbitrary command execution when processing user-controlled content.

The vulnerability requires two steps for exploitation: a Manager-level user uploads a malicious document containing Groovy Server Pages (GSP) expressions, and any authenticated user triggers the RCE by accessing the /document/buildZebraTemplate endpoint with the document ID. The endpoint does not validate that the document is of type ZEBRA_TEMPLATE before rendering it, allowing arbitrary GSP expressions to be executed.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your OpenBoxes instance is running a vulnerable version (up to 0.9.6). Inspect the DocumentController.groovy file for the buildZebraTemplate function using GroovyPagesTemplateEngine. Look for documents of type ZEBRA_TEMPLATE containing Groovy expressions like ${...} that could execute arbitrary code. Review logs for unauthorized access to /document/buildZebraTemplate endpoints.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to Remote Code Execution (RCE) on the server, allowing attackers to execute arbitrary commands. For organizations using OpenBoxes, this could mean unauthorized access to sensitive data, disruption of supply chain operations, or compromise of the entire system. The impact is particularly severe for healthcare and humanitarian organizations that rely on OpenBoxes for critical operations.

Exploitation requires an attacker to have at least Manager-level access to upload a malicious document, but the RCE can be triggered by any authenticated user, including those with minimal Browser role privileges. This increases the risk as a single compromised account could lead to full system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can severely impact compliance with GDPR and HIPAA. GDPR requires organizations to implement appropriate technical measures to ensure the security of personal data, including protection against unauthorized access or processing. A successful RCE could lead to unauthorized access to personal data, resulting in GDPR violations and potential fines.

HIPAA mandates strict safeguards for protected health information (PHI). A breach resulting from this vulnerability could expose PHI to unauthorized parties, leading to HIPAA violations, reputational damage, and significant financial penalties. Organizations must address this vulnerability promptly to maintain compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade OpenBoxes to version 0.9.8 or 0.9.8-hotfix1 immediately. Verify the patch deeac6a4a7aba86ce99c4bda37142e41d209293e is applied. Ensure document type validation is enforced before template rendering. Replace GroovyPagesTemplateEngine with BeanPropertyTemplateService to restrict property access and prevent Groovy code execution.

Useful 0 Not Useful 0