Cpe:2.3:a:floci:floci:1.1.0:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aflocifloci1.1.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 10 Oct 2026 19:55:48 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRemote Code Execution in Floci VtlTemplateEnginehttps://feed.craftedsignal.io/briefs/2026-10-floci-rce/Sat, 10 Oct 2026 19:55:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-floci-rce/An unauthenticated remote code execution vulnerability in Floci 1.1.0-2.1.9 allows attackers to achieve command execution via malicious Velocity templates.Floci versions 1.1.0 through 2.1.9 are susceptible to a critical remote code execution vulnerability (CVE-2026-108598) located within the VtlTemplateEngine component. The vulnerability arises from unrestricted processing of Velocity mapping templates used in API integrations. An unauthenticated attacker can exploit this by creating a REST API endpoint configured with a MOCK integration. By injecting malicious Velocity syntax that utilizes '$util' reflection, the attacker can access dangerous Java classes such as 'Runtime' or 'ProcessBuilder'. This allows the execution of arbitrary OS commands with the privileges of the Floci Java Virtual Machine process. This flaw poses a high risk to organizational infrastructure, as it provides a trivial vector for initial access and full system compromise without requiring authentication.

Attack Chain

  1. The attacker identifies an internet-facing instance of Floci.
  2. The attacker authenticates or interacts with the public API endpoint, specifically targeting the REST API integration management interface.
  3. The attacker creates a new MOCK integration via the Floci REST API.
  4. The attacker provides a custom Velocity template containing reflective payload syntax targeting 'java.lang.Runtime' or 'java.lang.ProcessBuilder'.
  5. The Floci application saves and subsequently evaluates the malicious template within the VtlTemplateEngine.
  6. The VtlTemplateEngine executes the reflected code within the JVM context.
  7. The attacker achieves arbitrary command execution on the underlying host operating system.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary system commands, leading to complete compromise of the Floci application host. Potential outcomes include full data exfiltration, persistent unauthorized access, lateral movement within the network, and the deployment of additional malware or ransomware.

Recommendation

Prioritized, concrete actions for detection engineering teams:

  • Upgrade all instances of Floci to version 2.2.0 or later to patch CVE-2026-108598.
  • If patching cannot be performed immediately, restrict network access to the Floci API management interface to trusted internal segments only.
  • Monitor webserver access logs for anomalous POST requests directed at API integration endpoints, specifically looking for Velocity template syntax or reflective Java keywords in request bodies.
]]>criticaladvisory