[Security Vulnerability] Fix for Server-Side Template Injection (SSTI) via #evaluate

[hayageek]

Summary

EscapeVelocity, does not sanitize user-controlled template variables passed to Template.evaluate(Map vars). When a template contains the #evaluate directive, the value of the evaluated variable is parsed and executed as a Velocity template. This allows Server-Side Template Injection (SSTI) and can lead to Remote Code Execution (RCE) via reflection.

Description

• Type: Server-Side Template Injection (SSTI) leading to Remote Code Execution
• Source: User-controlled template variables in the Map passed to Template.evaluate(Map vars)
• Sink: Parser.java lines 1486–1492: new Parser(new StringReader(value)).parse() and template.render()
• Data flow: User input in vars map → expression.evaluate(context) returns string → Parser parses string as template → template.render() executes injected directives (e.g. RCE via reflection)
• Impact: Full RCE when attacker can control template variables and the template uses #evaluate($var).