Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the xltpl library uses a npn-sandboxed Jinja environment for the processing of the template. Patches It has been patched in v9.1.0 Workarounds Disable the upload/usage of XLSX templates. References Are there any links users can visit to find out more? https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection/jinja2-ssti
Recommended action: Upgrade to 9.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact What kind of vulnerability is it? Who is impacted? A remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. Patches Has the problem been patched? What versions should users upgrade to? It has been patched in v6.5.2 References Are there any links users can visit to find out more? - https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection/jinja2-ssti POC Add the following to a document, upload and render it: The index might be different, so to debug this first render a template with {{ PLACEHOLDER.class.mro[1].subclasses() }} and then get the index of subprocess.Popen and replace 202 with that.
Recommended action: Upgrade to 6.5.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.