AI analysis
Apache Syncope, an open-source identity management system, is vulnerable to information disclosure (CWE-202) through crafted JEXL expressions in Derived Schemas. An administrator with Derived Schemas entitlements can define a malicious expression that uses one-hop JEXL navigation to bypass the JexlContextBuilder name denylist, causing sensitive attributes of a user's LinkedAccounts or Manager to be exposed to any administrator holding User read entitlements — potentially including hashed credentials. The flaw affects the 3.0.x, 4.0.x, and 4.1.x release lines up to 3.0.16, 4.0.7, and 4.1.2 respectively, and is fixed in 4.0.8 and 4.1.3. Exploitation requires privileged (administrator-level) access, so it primarily represents an insider-threat or compromised-admin-account risk rather than a remote unauthenticated attack. No CVSS score has been assigned yet, no public proof of concept is known, and there is no evidence of in-the-wild exploitation.
What to do: Upgrade to Apache Syncope 4.0.8 or 4.1.3 as soon as possible; note that no fix is listed for the 3.0.x line, so deployments on 3.0.0-M0–3.0.16 should migrate to a patched 4.x release. Audit existing Derived Schemas for JEXL expressions that navigate to LinkedAccount or Manager attributes, and restrict Derived Schemas entitlements to the minimum set of administrators. If a suspicious expression is found, review logs for users who queried it and rotate any credentials that may have been exposed.
Affected
| Apache Software Foundation Apache Syncope | 3.0.0-M0 through 3.0.16 |
| Apache Software Foundation Apache Syncope | 4.0.0-M0 through 4.0.7 |
| Apache Software Foundation Apache Syncope | 4.1.0-M0 through 4.1.2 |
Estimated exposure
nichelikely hundreds to low thousands of self-hosted deployments worldwide — Apache Syncope is a specialized, self-hosted enterprise identity-management platform with no published adoption metrics or public internet-exposure telemetry, so deployment counts are inferred to be small and predominantly internal-facing.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which allows any administrator with sufficient entitlements for User read to access LinkedAccount's (if present) or Manager's (if defined) sensitive information, possibly including hashed credentials. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.