APTRS 1.0 Jinja2 Template self.class.mro[1].subclasses neutralization of directive

Summaryinfo

A vulnerability classified as critical has been found in APTRS 1.0. The impacted element is the function self.class.mro[1].subclasses of the component Jinja2 Template Handler. Performing a manipulation results in neutralization of directive. This vulnerability is reported as CVE-2024-56363. The attack requires a local approach. No exploit exists. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability classified as critical has been found in APTRS 1.0. This affects the function self.class.mro[1].subclasses of the component Jinja2 Template Handler. The manipulation with an unknown input leads to a neutralization of directive vulnerability. CWE is classifying the issue as CWE-97. The product generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) directive. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed for penetration testers and security organizations. In 1.0, there is a vulnerability in the web application's handling of user-supplied input that is incorporated into a Jinja2 template. Specifically, when user input is improperly sanitized or validated, an attacker can inject Jinja2 syntax into the template, causing the server to execute arbitrary code. For example, an attacker might be able to inject expressions like {{ config }}, {{ self.class.mro[1].subclasses() }}, or more dangerous payloads that trigger execution of arbitrary Python code. The vulnerability can be reproduced by submitting crafted input to all the template fields handled by ckeditor, that are passed directly to a Jinja2 template. If the input is rendered without sufficient sanitization, it results in the execution of malicious Jinja2 code on the server.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2024-56363 since 12/20/2024. The exploitability is told to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available.

Applying the patch 9f6b6e4a56a9119eb12126a4909441e83b6d7c11 is able to eliminate this problem. The bugfix is ready for download at github.com.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• APTRS

Version

• 1.0

License

• open-source

Website

• Product: https://github.com/APTRS/APTRS/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion