0Xcan1337

**Name of the Vulnerable Software and Affected Versions** FOSSBilling versions 0.5.4 through 0.7.x **Description** An authorization bypass in the API role handling allows unauthenticated access to privileged '/api/system/*' endpoints. Because `system` resolves to the cron admin identity, attackers can invoke admin API methods without a valid session, credentials, or CSRF token. **Recommendations** Update to version 0.8.0. Block external access to '/api/system/*' at the reverse proxy or Web Application Firewall (WAF). Restrict API access to trusted source IPs using the `api.allowed ips` setting. Rotate all admin and client API tokens immediately. Invalidate active sessions and reset high-privilege credentials. Review API request logs for suspicious '/api/system/' access.

**Name of the Vulnerable Software and Affected Versions** FOSSBilling versions prior to 0.8.0 **Description** A Server-Side Template Injection (SSTI) issue exists in the template rendering system. Administrators with access to features that render Twig templates—such as email templates, mass mail campaigns, custom payment adapters, and the `string render` API endpoint—can inject arbitrary Twig expressions. This occurs because Twig templates are rendered without a sandbox, granting access to the full Twig environment, API context, and the application's dependency injection container, which can lead to information disclosure and remote code execution. Real-world exploitation has been observed in targeted campaigns. **Recommendations** Update to version 0.8.0. Audit existing email templates for suspicious Twig expressions. Rotate all admin and client API tokens. Block external access to the `/api/system/*` endpoint at the reverse proxy or WAF.