THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-32651

Server Side Template Injection in Jinja2 allows Remote Command Execution

Reserved:2024-04-16
Published:2024-04-25
Updated:2024-06-07

Description

changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn't required by the application (not by default and not enforced).



CRITICAL: 10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Problem types

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

Product status

<= 0.45.20
affected

References

https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4r7v-whpg-8rx3

https://github.com/dgtlmoon/changedetection.io/releases/tag/0.45.21

https://www.onsecurity.io/blog/server-side-template-injection-with-jinja2

https://blog.hacktivesecurity.com/index.php/2024/05/08/cve-2024-32651-server-side-template-injection-changedetection-io/

cve.org CVE-2024-32651

nvd.nist.gov CVE-2024-32651

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-32651