CVE-2021-44657

December 20, 2021

In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not enable sandboxed mode by default due to backwards compatibility. Stackstorm now sets sandboxed mode for jinja by default.

Summary:

In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not enable sandboxed mode by default due to backwards compatibility. Stackstorm now sets sandboxed mode for jinja by default.

Reference Links(if available):

  • https://podalirius.net/en/articles/python-vulnerabilities-code-execution-in-jinja-templates/
  • https://github.com/StackStorm/st2/pull/5359
  • https://github.com/pallets/jinja/issues/549
  • https://stackstorm.com/2021/12/16/stackstorm-v3-6-0-released/

  • CVSS Score (if available)

    v2: / MEDIUMAV:N/AC:L/Au:S/C:C/I:C/A:C

    v3: / HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

    Links to Exploits(if available)

  • You may have missed

    image

    [MEOW] – Ransomware Victim: Zyloware

    November 14, 2024
    image

    [MEOW] – Ransomware Victim: Cottles Asphalt Maintenance Inc

    November 14, 2024
    image

    [MEOW] – Ransomware Victim: Karl Malone Toyota

    November 14, 2024
    image

    [MEOW] – Ransomware Victim: Pine Belt Cars

    November 14, 2024
    image

    [MEOW] – Ransomware Victim: J[.]S[.]T[.] Espana

    November 14, 2024