PT-2022-11654 · Unknown · Pentest-Collaboration-Framework

Published 2022-05-11 · Updated 2022-05-19 · CVE-2021-42651

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pentest-Collaboration-Framework version 1.0.8

Description A Server Side Template Injection (SSTI) vulnerability allows an authenticated remote attacker to execute arbitrary code through the "/project/PROJECTNAME/reports/" API endpoint.

Recommendations For Pentest-Collaboration-Framework version 1.0.8, consider restricting access to the "/project/PROJECTNAME/reports/" endpoint until a patch is available. As a temporary workaround, limit the functionality of this endpoint to prevent arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2021-42651

Affected Products

Pentest-Collaboration-Framework

References · 5

• https://gitlab.com/invuls/pentest-projects/pcf/-/commit/67ca59ff668a4f361a0c6b1327287e484987b6f1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-42651 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42651 · Vendor Advisory
• https://t.me/cvenotify/30438 · Telegram Post
• https://t.me/cvenotify/30032 · Telegram Post