CVE-2025-70830: Datart Freemarker SSTI RCE Vulnerability

CVE-2025-70830 Overview

A Server-Side Template Injection (SSTI) vulnerability exists in the Freemarker template engine of Datart v1.0.0-rc.3. This vulnerability allows authenticated attackers to execute arbitrary code on the server by injecting crafted Freemarker template syntax into the SQL script field. SSTI vulnerabilities are particularly dangerous as they can lead to complete server compromise when template engines process user-controlled input without proper sanitization.

Critical Impact

Authenticated attackers can achieve arbitrary code execution on the underlying server, potentially leading to full system compromise, data exfiltration, and lateral movement within the network.

Affected Products

• Datart v1.0.0-rc.3

Discovery Timeline

• 2026-02-17 - CVE-2025-70830 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-70830

Vulnerability Analysis

This vulnerability falls under CWE-94 (Improper Control of Generation of Code - Code Injection). The Freemarker template engine in Datart processes user-supplied input within SQL script fields without adequate input validation or sandboxing. Freemarker is a Java-based template engine commonly used to generate dynamic content, and when improperly configured, it can expose dangerous built-in functions that allow arbitrary code execution.

Server-Side Template Injection occurs when an attacker is able to inject malicious template directives into a template that is then processed by the server-side template engine. In this case, the SQL script field accepts Freemarker syntax, which the engine evaluates during template rendering. This allows attackers to break out of the intended data context and execute arbitrary Freemarker directives, including those that can invoke Java methods directly.

The vulnerability requires authentication, meaning an attacker must first have valid credentials to access the Datart application before exploiting this flaw. However, once authenticated, the attacker can leverage the SSTI to execute operating system commands, read sensitive files, establish reverse shells, or perform other malicious actions with the privileges of the application server.

Root Cause

The root cause of this vulnerability is the lack of proper input sanitization and inadequate sandboxing of the Freemarker template engine. When user-controlled data is passed directly to the template engine for processing without filtering dangerous template syntax, attackers can inject malicious template expressions. The Freemarker engine, by default, provides access to powerful built-in functions including the ability to instantiate Java objects and invoke methods, which can be abused to achieve code execution.

Attack Vector

The attack is network-based and requires low complexity to exploit. An authenticated attacker can craft a malicious payload containing Freemarker template syntax and inject it into the SQL script field within the Datart application. When the application processes this input through the Freemarker template engine, the injected template code is evaluated, leading to arbitrary code execution on the server.

The attack leverages Freemarker's built-in mechanisms to access Java classes and methods. Common exploitation techniques involve accessing the freemarker.template.utility.Execute class or using Freemarker's new() built-in to instantiate dangerous Java objects. The attacker can then invoke methods such as Runtime.getRuntime().exec() to execute arbitrary system commands.

For detailed information on Server-Side Template Injection attacks, see the PortSwigger SSTI Research. The Datart project repository and CVE-2025-70830 exploit repository provide additional technical context.

Detection Methods for CVE-2025-70830

Indicators of Compromise

• Unusual template syntax patterns in SQL script field inputs, particularly containing Freemarker directives like <#assign>, ${...}, or <#list>
• Server logs showing Java class instantiation attempts through template processing, especially references to Runtime, ProcessBuilder, or Execute
• Unexpected outbound network connections from the Datart application server
• Evidence of command execution in application logs or process monitoring tools
• Presence of new files or modifications to existing files on the server with application service account ownership

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common SSTI payloads targeting Freemarker template syntax
• Monitor application logs for template parsing errors or exceptions that may indicate exploitation attempts
• Deploy endpoint detection solutions to identify suspicious process spawning from the Java application process
• Establish baseline behavior for the Datart application and alert on anomalous activities such as unexpected child processes

Monitoring Recommendations

• Enable detailed logging for the Datart application, particularly for SQL script field submissions and template processing
• Configure security information and event management (SIEM) alerts for patterns matching known Freemarker exploitation techniques
• Monitor network traffic from the application server for unusual outbound connections or data exfiltration indicators
• Implement file integrity monitoring on critical server directories to detect unauthorized modifications

How to Mitigate CVE-2025-70830

Immediate Actions Required

• Restrict access to the Datart application to only trusted authenticated users until a patch is available
• Implement network segmentation to limit the blast radius if the application server is compromised
• Deploy WAF rules to filter requests containing known SSTI payloads
• Review and audit existing user accounts for unnecessary access privileges
• Monitor the application closely for signs of exploitation

Patch Information

As of the last NVD update on 2026-02-18, no official patch has been published by the Datart project. Organizations should monitor the Datart GitHub repository for security updates and apply patches as soon as they become available. Consider implementing the workarounds below until an official fix is released.

Workarounds

• Configure Freemarker to use a restrictive sandbox configuration that disables dangerous built-ins such as new(), api, and exec
• Implement strict input validation on the SQL script field to reject or sanitize template syntax before processing
• Deploy the Datart application with minimal privileges to reduce the impact of successful exploitation
• Consider placing the application behind an additional authentication layer to limit the attack surface
• Disable or restrict access to the SQL script functionality if it is not essential to business operations

# Example: Restrict Freemarker configuration (implementation varies by deployment)
# Add to Datart configuration or create a custom TemplateLoader
# Disable new_builtin_class_resolver to prevent arbitrary class instantiation
freemarker.new_builtin_class_resolver=safer
freemarker.api_builtin_enabled=false