Apache Syncope CVE-2025-57738

Requires an authenticated Apache Syncope administrator (PR:H) with access to the feature that lets deployments provide custom Java-interface implementations as Groovy classes, which are compiled and runtime-reloaded by the Syncope Core. The exploit condition is precisely that a user holding administrative rights can author/upload Groovy code; it is not reachable by unauthenticated or low-privileged users. Exploitation is limited to versions prior to 3.0.14 (3.0.x branch) and 4.0.2 (4.0.x branch) - the fix forces Groovy code to run in a sandbox. Limiting factors: attacker must already control an administrator account, no user interaction by a victim is needed, and no unusual non-default configuration is required since the Groovy extension mechanism is a standard product feature.

This is a genuine but access-gated vulnerability rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, score 7.2 High) is internally consistent with the description: exploitation is network-reachable and low-complexity, but PR:H correctly reflects that only a high-privileged administrator can inject the malicious Groovy code. The full C:H/I:H/A:H impact is justified because Groovy executes as code inside the running Syncope Core, yielding effective code execution on the host. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the primary limiting factor is the trust boundary itself (the attacker must already be, or must compromise, a Syncope administrator). This is a privilege-escalation/sandbox-escape issue (CWE-653, improper compartmentalization) where a nominally lower-trust admin role gains full code execution; prioritize it where administrators are numerous, delegated, or federated, but it is not a drive-by unauthenticated RCE. Note: the vector is AV:N because the admin console/REST API is network-exposed, yet the attacker is an authenticated administrator - treat 'network' here as 'authenticated remote admin,' not anonymous internet access.

A malicious or compromised Apache Syncope administrator supplies a custom Groovy implementation for one of the extensible Java interfaces via the admin console/REST API. Because the Groovy machinery supports runtime reload and was not sandboxed, the injected code executes directly within the running Syncope Core process, giving the attacker arbitrary code execution on the host. No public exploit code was identified in the provided data.