CVE-2021-46361: FreeMarker Restriction Bypass in Magnolia CMS

An issue in the FreeMarker Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary code via a crafted FreeMarker payload.

Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found here.

Proof Of Concept:

More details and the exploitation process can be found in this PDF.

Additional Resources:

The SSTI gadget used to escape the FreeMarker sandbox was inspired from this article by Vincent Herbulot of Synacktiv