PT-2022-24057 · Unknown · Pebble Templates

Y4Tacker · Published 2022-09-12 · Updated 2024-08-03 · CVE-2022-37767

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pebble Templates version 3.1.5

Description The issue allows attackers to bypass a protection mechanism and implement arbitrary code execution with springbok. It is noted that the vendor disputes this, as input to the Pebble templating engine is intended to include arbitrary Java code. The vendor suggests that either the input should not arrive from an untrusted source, or else the application using the engine should apply restrictions to the input, as the engine is not responsible for validating the input.

Recommendations For version 3.1.5, consider applying restrictions to the input of the Pebble templating engine to prevent arbitrary code execution, or ensure that the input does not arrive from an untrusted source. As a temporary workaround, consider restricting the use of the springbok functionality until a more robust solution is implemented.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-37767

GHSA-WXX5-W9JC-48WX

Affected Products

Pebble Templates

References · 8

• 🔥 https://github.com/PebbleTemplates/pebble/issues/625#issuecomment-1282138635 · Exploit
• 🔥 https://github.com/Y4tacker/Web-Security/issues/3 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-37767 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37767 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wxx5-w9jc-48wx · Vendor Advisory
• https://t.me/cibsecurity/49586 · Telegram Post
• https://t.me/cvenotify/88756 · Telegram Post
• https://t.me/cvenotify/36043 · Telegram Post