PT-2019-15992 · Pebble · Pebble Templates

Ismai1337 · Publicado 2019-12-18 · Atualizado 2022-05-24 · CVE-2019-19899

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pebble Templates versions prior to 3.1.4

Description The issue allows attackers to bypass a protection mechanism intended to block access to instances of java.lang.Class because getClass is accessible via the public static java.lang.Class java.lang.Class.forName(java.lang.Module,java.lang.String) signature. This enables potential exploitation by accessing sensitive classes.

Recommendations For versions prior to 3.1.4, update to version 3.1.4 or later to resolve the issue.

Exploit

Correção

Missing Authorization

RCE

Enumeração de Fraquezas

CWE-862

CWE-20

Identificadores relacionados

CVE-2019-19899

GHSA-83M8-7HJ8-FF5W

Produtos afetados

Pebble Templates

Referências · 7

• 🔥 https://github.com/PebbleTemplates/pebble/issues/493 · Exploit
• https://github.com/PebbleTemplates/pebble · Nota
• https://github.com/PebbleTemplates/pebble/pull/511 · Nota
• https://osv.dev/vulnerability/GHSA-83m8-7hj8-ff5w · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-19899 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-19899 · Aviso do Fabricante
• https://research.securitum.com/server-side-template-injection-on-the-example-of-pebble · Nota