Floci
Monthly
Unauthenticated remote code execution affects Floci versions 1.1.0 through releases prior to 2.2.0, where the API Gateway VTL template engine fails to sandbox Velocity template rendering. An attacker who can reach the Floci control plane can define a REST API with a MOCK integration whose mapping template uses $util reflection to reach Runtime or ProcessBuilder, executing arbitrary OS commands inside the Floci JVM - a CVSS 9.3 (CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) impact confirmed as unauthenticated by the PR:N vector. Publicly available exploit code exists, though no public exploit identified at time of analysis as confirmed actively exploited (CISA KEV), and a vendor-released fix is available in Floci 2.2.0. Because Floci is primarily a local and CI developer emulator of AWS services, practical exposure depends heavily on whether its API Gateway/AppSync endpoints are bound beyond localhost.
Unauthenticated remote code execution affects Floci versions 1.1.0 through releases prior to 2.2.0, where the API Gateway VTL template engine fails to sandbox Velocity template rendering. An attacker who can reach the Floci control plane can define a REST API with a MOCK integration whose mapping template uses $util reflection to reach Runtime or ProcessBuilder, executing arbitrary OS commands inside the Floci JVM - a CVSS 9.3 (CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) impact confirmed as unauthenticated by the PR:N vector. Publicly available exploit code exists, though no public exploit identified at time of analysis as confirmed actively exploited (CISA KEV), and a vendor-released fix is available in Floci 2.2.0. Because Floci is primarily a local and CI developer emulator of AWS services, practical exposure depends heavily on whether its API Gateway/AppSync endpoints are bound beyond localhost.