PT-2023-33028 · Fief · Fief

Published 2023-06-23 · Updated 2023-06-23

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fief (affected versions not specified)

Description The issue is related to Server-Side Template Injection (SSTI), a vulnerability within application templating engines where user input is improperly handled and embedded into the template, possibly leading to code execution. An attacker can use SSTI to execute code on the underlying system by manipulating values within the embedded template. This can allow an attacker to run permissioned commands under the exploited process or exploit Cross-Site Scripting (XSS) to run code within the user's browser. SSTI can lead to reputational damage for the business due to a loss in confidence and trust by users, and if an attacker successfully executes code within the underlying system, it can result in data theft and indirect financial losses.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-HJ8M-9FHF-V7JP

Affected Products

Fief

References · 5

• https://osv.dev/vulnerability/GHSA-hj8m-9fhf-v7jp · Vendor Advisory
• https://github.com/fief-dev/fief/releases/tag/v0.25.3 · Note
• https://github.com/fief-dev/fief · Note
• https://github.com/fief-dev/fief/security/advisories/GHSA-hj8m-9fhf-v7jp · Note
• https://github.com/fief-dev/fief/commit/91e56625b641fa419e2985772266774bae18382b · Note