Apache Syncope Vulnerabilities Allow Attackers to Execute Malicious Code and Bypass Controls

Apache Syncope, an open-source identity management (IdM) server, exposes sensitive information to an unauthorized actor through its REST API: an administrator with adequate entitlements can retrieve the list of all existing access tokens, including their signed JWT bodies. By replaying one of these stolen JWTs, that administrator can issue further REST requests while impersonating users who hold higher administration entitlements, effectively escalating to full administrative control of the identity deployment. The flaw affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, and is fixed in 4.0.8 and 4.1.3. No CVSS score has been assigned yet, no public proof-of-concept is known, and there is no evidence of exploitation in the wild.

Do: Upgrade to Apache Syncope 4.0.8 or 4.1.3 as soon as possible — the 3.0.x line has no fixed release, so 3.0.16 users must migrate to a patched 4.x version. After upgrading, revoke and reissue all access tokens and review REST audit logs for any administrative enumeration of the token list or anomalous authenticated requests. Until patched, restrict the entitlements that permit listing access tokens via REST.

Apache Syncope contains a code injection vulnerability (CWE-94) in which an administrator holding entitlements over Implementations can define a malicious Groovy Command class whose CommandArgs static implementation contains untrusted code, bypassing the Groovy security sandbox. Successful exploitation executes arbitrary code on the Syncope server with the privileges of the application, giving the attacker full read and write access to managed identity data and potentially broader host compromise. The flaw requires high privileges (a Syncope administrator, not an end user), which limits the attack surface to insider threats, compromised admin accounts, or environments where Implementation rights are delegated too broadly. All Syncope 3.0.0-M0–3.0.16, 4.0.0-M0–4.0.7, and 4.1.0-M0–4.1.2 deployments are affected; there is no evidence of in-the-wild exploitation and no public proof of concept is known.

Do: Upgrade to Apache Syncope 4.0.8 or 4.1.3 immediately; since the 3.0.x line has no listed fix, 3.0.16 and earlier deployments should migrate to 4.0.8+ or 4.1.3+. In the interim, restrict the 'Implementations' entitlement to a minimal set of fully trusted administrators and audit existing Groovy Command and CommandArgs implementations for unexpected or recently added code. Review Syncope admin and audit logs for suspicious Implementation creation events, especially if admin credentials are shared or delegated to multiple operators.

Apache Syncope contains a SQL injection flaw (CWE-89) in the Task search function, where sort clauses are passed to the database without proper neutralization of special elements. An administrator with adequate entitlements can exploit this through stacked queries to execute arbitrary SQL against the backend database. Successful exploitation allows the attacker to read, modify, or delete data at the level of the database account used by Syncope, making this primarily a risk from malicious or compromised privileged accounts. All users of Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 are affected. No CVSS score has been assigned, the issue is not in the CISA KEV catalog, and no public proof-of-concept or observed exploitation is known at this time.

Do: Upgrade to Apache Syncope 4.0.8 or 4.1.3, which fix the issue; note that no fixed 3.0.x release is listed, so 3.0.16-and-earlier deployments should migrate to a patched 4.x release. As defense in depth, restrict Syncope administrative entitlements to the minimum necessary set of users and review who can invoke Task searches. Check database audit logs for unexpected stacked or multi-statement queries originating from the Syncope service account to rule out prior abuse.