CVE-2018-19907: OS Command Injection in craftercms:crafter-studio
Summary
CVE-2018-19907: OS Command Injection in craftercms:crafter-studio. Affects org.craftercms:crafter-studio versions < 3.0.18. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Crafter CMS is an open-source content management system that allows developers to create and manage websites. The crafter-studio package is a component of Crafter CMS that provides a web-based interface for content management. This package is vulnerable to a Server-Side Template Injection issue, which can be exploited by attackers with developer privileges. By creating or editing a template file with a specific file type (.ftl), an attacker can trigger a call to the freemarker.template.utility.Execute function in the FreeMarker library during the rendering of a web page.
Vulnerability Detail
The OS Command Injection vulnerability in Crafter CMS 3.0.18 allows attackers with developer privileges to execute arbitrary operating system commands. By manipulating the template file, an attacker can inject malicious commands that will be executed when the web page is rendered. This can lead to unauthorized access, data leakage, or even complete compromise of the affected system. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can disable the ability for users to create or edit template files with the .ftl file type. This can be done by implementing proper input validation and filtering to prevent the execution of arbitrary commands. Here is an example of how to validate and filter template files in Java:
String templateFile = request.getParameter("templateFile");
if (templateFile.endsWith(".ftl")) {
// Handle error or reject the file
}
Conclusion
The OS Command Injection vulnerability in craftercms:crafter-studio can allow attackers with developer privileges to execute arbitrary operating system commands. It is crucial to upgrade to a non-affected version of Crafter CMS and validate template files to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.craftercms:crafter-studio →
FAQ
Crafter CMS is an open-source content management system that allows developers to create and manage websites.
The crafter-studio package is a component of Crafter CMS that provides a web-based interface for content management.
Server-Side Template Injection is a vulnerability that allows an attacker to inject malicious code into template files, which are then executed on the server-side during the rendering of a web page.
This vulnerability can lead to unauthorized access, data leakage, or even complete compromise of the affected system.
To protect your application, it is recommended to upgrade to a version of Crafter CMS that is not affected by this issue and to validate and filter any template files used in your application.
Related vulnerabilities
Recent vulnerabilities recorded for org.craftercms:crafter-studio.
