Remote Code Execution via Velocity scripts (Macro)

A Remote Code Execution (RCE) vulnerability exists in the Velocity macro and can be exploited by an authenticated user with script permissions.
The application allows users to create Velocity scripts; consequently, an attacker can inject arbitrary Velocity expressions or other malicious template syntax that are evaluated server-side, bypassing the Velocity sandbox.
By crafting a specially designed payload, the attacker can execute arbitrary commands on the underlying operating system with the privileges of the web application.

Payload :

$request.request.getServletContext().getAttribute("org.apache.tomcat.InstanceManager").newInstance("org.apache.batik.script.jpython.JPythonInterpreter").evaluate("import os; os.system('touch /tmp/RCE')")