CVE-2024-32651 Server Side Template Injection in Jinja2 allows Remote Command Execution

2024-04-2523:49:28

CWE-1336

GitHub_M

github.com

cve-2024-32651

server side template injection

jinja2

remote command execution

attackers

system command

reverse shell

critical impact

server takeover

application security

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

7.4

Confidence

Low

EPSS

0.001

Percentile

29.0%

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

total

JSON

changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn’t required by the application (not by default and not enforced).

CNA Affected

[
  {
    "vendor": "dgtlmoon",
    "product": "changedetection.io",
    "versions": [
      {
        "version": "<= 0.45.20",
        "status": "affected"
      }
    ]
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:dgtlmoon:changedetection.io:0.45.20:*:*:*:*:*:*:*"
    ],
    "vendor": "dgtlmoon",
    "product": "changedetection.io",
    "versions": [
      {
        "status": "affected",
        "version": "0.45.20"
      }
    ],
    "defaultStatus": "unknown"
  }
]