PT-2023-28906 · Cachet+1 · Cachet+1

Rive-N

·

Published

2023-10-11

·

Updated

2023-10-19

·

CVE-2023-43661

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Name of the Vulnerable Software and Affected Versions Cachet versions prior to 2.4
Description A template functionality in Cachet allows users to create templates, which can lead to the execution of any code on the server due to bad filtration and an old twig version. This issue can be exploited through the /api/v1/incidents API endpoint, where an attacker can control the template input passed to the CreateIncidentCommandHandler.php handler. If an attacker can control this data, they may be able to trigger a server-side template injection vulnerability, leading to remote code execution. The vulnerability exists in the processing of data by Cachet without filtration, not within the Twig library itself.
Recommendations Update to Cachet version 2.4 or later to patch this issue. As a temporary workaround, consider filtering user-controlled data by a safe pattern to minimize the risk of exploitation. Restrict access to the /api/v1/incidents API endpoint for non-admin users to prevent triggering this vulnerability. Use sandboxed twig mode to limit the potential damage from template injection attacks.

Exploit

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74CWE-94

Related Identifiers

CVE-2023-43661
GHSA-HV79-P62R-WG3P

Affected Products

Cachet
Twig