PT-2022-8884 · Form.Io · Form.Io

Published 2022-05-31 · Updated 2024-08-04 · CVE-2020-28246

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Form.io version 2.0.0

Description A Server-Side Template Injection (SSTI) issue was discovered, leading to Remote Code Execution during the deletion of the default Email template URL. The email templating service was removed after 2020. The vendor disputes this issue, indicating it is sandboxed and only executable by admins.

Recommendations For Form.io version 2.0.0, as a temporary workaround, consider restricting access to the default Email template URL deletion functionality until a patch is available. Additionally, since the email templating service was removed after 2020, ensuring this service is not re-enabled can help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2020-28246

GHSA-52VJ-MR2J-F8JH

Affected Products

Form.Io

References · 6

• https://osv.dev/vulnerability/GHSA-52vj-mr2j-f8jh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28246 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28246 · Vendor Advisory
• https://github.com/formio/formio · Note
• https://github.com/formio/enterprise-release/blob/master/API-Server-Change-Log.md · Note
• https://t.me/cvenotify/77730 · Telegram Post