| Título | JumpServer 4.10.19 OS Command Injection |
|---|
| Descripción | JumpServer v4.10.19 lacks backend input filtering, making it vulnerable to SSTI injection, which can execute arbitrary system commands
In the backend management section, when adding an asset, the IP/HOST field contains SSTI (Service Scripting Instructions for Actions), which can be used to write command execution content. When the template is rendered, the SSTI is triggered, causing the command to execute |
|---|
| Fuente | ⚠️ https://gist.github.com/Seikruun/b628bb6d4403d9c41a54a4b92d775583 |
|---|
| Usuario | seikruun (UID 100457) |
|---|
| Sumisión | 2026-09-08 18:03 (hace 2 meses) |
|---|
| Moderación | 2026-10-19 09:24 (1 month later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 422286 [JumpServer hasta 4.10.19 Template Rendering IP/HOST escalada de privilegios] |
|---|
| Puntos | 19 |
|---|