Apache Syncope has identified three significant vulnerabilities that could enable privileged administrators to execute arbitrary SQL commands, bypass Groovy sandbox protections to inject code, and hijack higher-privileged user sessions through exposed JWT access tokens. Organizations utilizing affected instances of the identity-management platform should prioritize upgrades to Syncope 4.0.8 or 4.1.3, which address all three vulnerabilities. The issue arises from the failure to properly neutralize SQL special characters within sort clauses used during Task search operations.

This type of attack involves appending additional SQL commands to legitimate queries, enabling the attacker to read, modify, or delete database records based on the application's database account permissions.

An administrator with sufficient Implementations entitlements can create a malicious Groovy Command class with untrusted code in its static CommandArgs implementation, potentially leading to a sandbox escape and executing code outside of expected restrictions. Organizations should also review administrator entitlements, restrict access to Task search and implementation management functions, and monitor REST API logs for suspicious token enumeration, unusual sorting inputs, or unexpected Groovy implementation creation. Explore for your team.