CVE-2024-32651 Server Side Template Injection in Jinja2 allows Remote Command Execution

2024-04-2523:49:28

CWE-1336

GitHub_M

www.cve.org

cve-2024-32651

jinja2

remote command execution

server side template injection

ssti

server takeover

changedetection

open source

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

10 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.1%

JSON

changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn’t required by the application (not by default and not enforced).

CNA Affected

[
  {
    "vendor": "dgtlmoon",
    "product": "changedetection.io",
    "versions": [
      {
        "version": "<= 0.45.20",
        "status": "affected"
      }
    ]
  }
]