422 – Server side template injection
Description
The application allows injecting malicious entries into a server-side command template. This vulnerability occurs when an attacker can use the template's template syntax to inject a malicious payload into a template, which is then executed on the server side.
Impact
- Execute commands remotely - View the contents of sensitive files stored on the server. - Obtain sensitive information. - Read system files. - Cause strange behavior on the server.
Recommendation
Properly sanitize user-controlled inputs. Encourage the use of sandboxing.
Threat
Unauthenticated attacker from the Internet.
Expected Remediation Time
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: N
- Attack complexity: L
- Attack Requirements: N
- Privileges required: N
- User interaction: N
- Confidentiality (VC): L
- Integrity (VI): L
- Availability (VA): N
- Confidentiality (SC): L
- Integrity (SI): L
- Availability (SA): L
Threat 4.0
- Exploit maturity: A