CVE-2023-1306 Rapid7 InsightCloudSec resource.db() method access

High 8.8 Published 21 Mar 2023 Updated 26 Feb 2025

Authenticated attackers can execute arbitrary code via Jinja template injection in Rapid7 InsightCloudSec.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-1306?

CVE-2023-1306 is a high-severity code injection vulnerability in Rapid7 InsightCloudSec, published on 21 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls via a Jinja template, which can lead to code execution. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.

Weakness: CWE-94

Which versions are affected by CVE-2023-1306?

It affects 2 products.

Products include Rapid7 Insightappsec, Rapid7 Insightcloudsec.

How do I fix CVE-2023-1306?

No fix has been published for CVE-2023-1306 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-1306 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-1306 exists.

Sources

Also known as GHSA-8xwh-69g8-mr3r.