CVE-2024-55652 - PwnDoc Server-Side Template Injection vulnerability - Sandbox Escape to RCE using custom filters

Back Back to CVE browser

MEDIUM

PwnDoc Server-Side Template Injection vulnerability - Sandbox Escape to RCE using custom filters

Published Dec 11, 2024

6.5

MEDIUM

CVSS 3.1

EPSS 0.67%

Description

PenDoc is a penetration testing reporting application. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an attacker can write a malicious docx template containing expressions that escape the JavaScript sandbox to execute arbitrary code on the system. An attacker who can control the contents of the template document is able to execute arbitrary code on the system. By default, only users with the `admin` role are able to create or update templates. Commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 patches the issue.

Affected products

Vendor Pwndoc Product Pwndoc Default
n/a
- Version
  < 1d4219c596f4f518798492e48386a20c6e9a2fe6
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Pwndoc

n/a

Version	Status	Constraints
< 1d4219c596f4f518798492e48386a20c6e9a2fe6	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-1336

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-52835
Advisory
https://github.com/pwndoc/pwndoc/blob/main/backend/src/lib/report-filters.js#L258-L260
x_refsource_MISC
https://github.com/pwndoc/pwndoc/commit/1d4219c596f4f518798492e48386a20c6e9a2fe6
x_refsource_MISC
https://github.com/pwndoc/pwndoc/security/advisories/GHSA-jw5r-6927-hwpc
exploitx_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-52835		Advisory
https://github.com/pwndoc/pwndoc/blob/main/backend/src/lib/report-filters.js#L258-L260		x_refsource_MISC
https://github.com/pwndoc/pwndoc/commit/1d4219c596f4f518798492e48386a20c6e9a2fe6		x_refsource_MISC
https://github.com/pwndoc/pwndoc/security/advisories/GHSA-jw5r-6927-hwpc		exploitx_refsource_CONFIRM