| Titolo | JumpServer 4.10.19 OS Command Injection |
|---|
| Descrizione | JumpServer v4.10.19 lacks backend input filtering, making it vulnerable to SSTI injection, which can execute arbitrary system commands
In the backend management section, when adding an asset, the IP/HOST field contains SSTI (Service Scripting Instructions for Actions), which can be used to write command execution content. When the template is rendered, the SSTI is triggered, causing the command to execute |
|---|
| Fonte | ⚠️ https://gist.github.com/Seikruun/b628bb6d4403d9c41a54a4b92d775583 |
|---|
| Utente | seikruun (UID 100457) |
|---|
| Sottomissione | 08/09/2026 18:03 (2 mesi fa) |
|---|
| Moderazione | 19/10/2026 09:24 (1 month later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 422286 [JumpServer fino a 4.10.19 Template Rendering IP/HOST escalationi di privilegi] |
|---|
| Punti | 19 |
|---|