PT-2024-19473 · Beetl · Beetl

Wooclee · Published 2024-02-01 · Updated 2025-06-06 · CVE-2024-22533

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Beetl versions prior to 3.15.12

Description The rendering template in Beetl has a server-side template injection (SSTI) vulnerability. When the incoming template is controllable, it will be filtered by the DefaultNativeSecurityManager blacklist. However, because the blacklist filtering is not strict, the blacklist can be bypassed, leading to arbitrary code execution.

Recommendations For versions prior to 3.15.12, update to version 3.15.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the rendering template to minimize the risk of exploitation. Additionally, ensure that the incoming template is not controllable by an attacker to prevent bypassing the DefaultNativeSecurityManager blacklist.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-22533

GHSA-9GH8-877R-G477

Affected Products

Beetl

References · 9

• 🔥 https://gitee.com/xiandafu/beetl/issues/I8RU01 · Exploit
• https://osv.dev/vulnerability/CVE-2024-22533 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22533 · Security Note
• https://osv.dev/vulnerability/GHSA-9gh8-877r-g477 · Vendor Advisory
• https://twitter.com/CVEnew/status/1753246271417065837 · Twitter Post
• https://gitee.com/xiandafu/beetl · Note
• https://twitter.com/VulmonFeeds/status/1753308234079776958 · Twitter Post
• https://t.me/cvenotify/124947 · Telegram Post
• https://t.me/cvenotify/70935 · Telegram Post