PT-2021-24142 · Unknown+1 · Stackstorm+1

Published 2021-12-15 · Updated 2022-07-12 · CVE-2021-44657

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: StackStorm versions prior to 3.6.0

Description: The issue arises from the jinja interpreter not being run in sandbox mode, allowing the execution of unsafe system commands. This is due to jinja not enabling sandboxed mode by default for backwards compatibility reasons. However, StackStorm now sets sandboxed mode for jinja by default.

Recommendations: For versions prior to 3.6.0, update to version 3.6.0 or later to enable sandboxed mode for the jinja interpreter by default. As a temporary workaround, consider configuring the jinja interpreter to run in sandbox mode manually until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2021-44657

Affected Products

Stackstorm

Jinja

References · 7

• 🔥 https://github.com/pallets/jinja/issues/549 · Exploit
• 🔥 https://podalirius.net/en/articles/python-vulnerabilities-code-execution-in-jinja-templates · Exploit
• https://github.com/StackStorm/st2/pull/5359 · Patch
• https://stackstorm.com/2021/12/16/stackstorm-v3-6-0-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44657 · Security Note
• https://osv.dev/vulnerability/CVE-2021-44657 · Vendor Advisory
• https://t.me/cibsecurity/34024 · Telegram Post