PT-2019-15992 · Pebble · Pebble Templates

Ismai1337 · Published 2019-12-18 · Updated 2022-05-24 · CVE-2019-19899

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pebble Templates versions prior to 3.1.4

Description The issue allows attackers to bypass a protection mechanism intended to block access to instances of java.lang.Class because getClass is accessible via the public static java.lang.Class java.lang.Class.forName(java.lang.Module,java.lang.String) signature. This enables potential exploitation by accessing sensitive classes.

Recommendations For versions prior to 3.1.4, update to version 3.1.4 or later to resolve the issue.

Exploit

Fix

Missing Authorization

RCE

Weakness Enumeration

CWE-862

CWE-20

Related Identifiers

CVE-2019-19899

GHSA-83M8-7HJ8-FF5W

Affected Products

Pebble Templates

References · 7

• 🔥 https://github.com/PebbleTemplates/pebble/issues/493 · Exploit
• https://osv.dev/vulnerability/GHSA-83m8-7hj8-ff5w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19899 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19899 · Vendor Advisory
• https://github.com/PebbleTemplates/pebble · Note
• https://github.com/PebbleTemplates/pebble/pull/511 · Note
• https://research.securitum.com/server-side-template-injection-on-the-example-of-pebble · Note