CVE-2025-58059: Valtimo scripting engine can be used to gain access to sensitive data or resources

The vulnerability in Valtimo's scripting engine is due to an insecure configuration of the underlying Camunda BPM engine. By default, Camunda's scripting engine does not sandbox script execution, allowing scripts to access any Java class on the classpath. This can be exploited by an attacker with admin privileges to execute arbitrary code on the server by creating a malicious process definition.

The patch for this vulnerability introduces a sandboxing mechanism by providing a custom ScriptEngineResolver. The analysis of the patch commit 45eb60b0b2df5964fb9917295d0dceb1fff8dd85 reveals the addition of three key components that work together to mitigate the vulnerability:

1. CamundaContextConfiguration.scriptingWhitelistPlugin: This new Spring bean is the entry point for the fix. It creates an instance of the ScriptingWhitelistPlugin.

2. ScriptingWhitelistPlugin.preInit: This plugin's preInit method is called during the Camunda engine's startup. It configures the engine to use a new, secure ScriptEngineResolver.

3. AllowedClassesScriptEngineResolver.getJavaScriptScriptEngine: This is the core of the sandboxing mechanism. It returns a GraalJS script engine that is configured with a whitelist of allowed classes. Any attempt to access a class not on the whitelist from a script will be blocked.

The vulnerability is therefore not a flaw in a single function, but a configuration oversight in how Valtimo integrates the Camunda engine. The identified functions are the ones added by the patch to correct this oversight. During exploitation of a vulnerable version, a runtime profile would likely show calls within the Camunda script execution engine, but the root cause lies in the lack of the secure configuration provided by the functions listed above.