With the recently published Lucee vulnerabilities (https://www.hoyahaxa.com/2024/02/thinking-defensively-about-three-recent.html), I see that the RCE issue with isDefined(), structGet() and empty() can be prevented using the new

lucee.security.limitEvaluation

environment property, but it requires Lucee 5.4.5.8 or higher, which are currently only available as Snapshots. Any idea when a production release of 5.4.5.x will be made?

I second that - will it be available as a version 5.x fix?

Even if you're not patched - you can avoid being vulnerable/exploitable by not passing user-controlled input to those functions, and by configuring the client management/client storage settings as described. That was the gist of what I was trying to get across in the post.

@Brian Reilly Good point. Our servers are actually not vulnerable to these issues today, but you never know what tomorrow might bring. 🙂 I'd rather get them locked down so that if some code that would be vulnerable gets added in the future, we're still protected.

@dswitzer yup - agree completely 🙂

Question, does the new setting fix the issue, or does it just block any possible isdefined()-vulnerabel cfml code, such as isdefined(url.something)? @dswitzer

@Andreas No clue. I haven't tested it, since it's still just in a SNAPSHOT release.

I'm going go check myself.

All I know from the dev team is that they prepare a release, but no clue as of when it will be released. You’re right, it was patched in 5.4.5.8. I will see I get some more info on when the release for 5.4.5.x will be out

@Andreas There are a couple of vulnerabilities at play here, but I assume you're asking about the variable evaluation one. As I understand it - enabling this setting will prevent the arguments to the affected functions/tags from being evaluated as CFML code, and will instead be treated as a literal string. So with the setting enabled,

isDefined(x[imageRead('something')])

for example, would test to see if

x[imageRead('something')]

existed, versus evaluating (executing)

imageRead('something')

and testing if

x[_*OUTPUT_FROM_THAT_EVALUATED_RESULT]*_

existed

It just breaks the code.

@Andreas What do you mean by "it just breaks the code"? Does that mean something like

isDefined("url.someVar")

throws an error? Or does it mean something like

isDefined('url.#someDynamicVar#')

does not evaluate

#someDynamicVar#

? I was under the assumption that it meant that when evaluating

#someDynamicVar#

it just wouldn't allow

#someDynamicVar#

to point to some other path so that it could not evaluate to something like ``isDefined('url.form.someVar')`` if

#someDynamicVar#

was equal to

form.someVar

.

Yeah - it looks like it throws an

invalid syntax, variables are not supported.

exception -

Does it work with variables that are not in public scopes (i.e.

#variables.someVar#

) or does it throw the same error.

Quick testing -

variables.someVar = 'test';

- no exception

variables.someVar = 'test[x]';

- exception