CVE-2024-55652 PwnDoc Server-Side Template Injection vulnerability - Sandbox Escape to RCE using custom filters
An attacker with admin privileges can execute arbitrary code on the server by uploading a malicious document template that escapes the JavaScript sandbox.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-55652?
CVE-2024-55652 is a medium-severity code injection vulnerability in pwndoc, published on 11 Dec 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
PenDoc is a penetration testing reporting application. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an attacker can write a malicious docx template containing expressions that escape the JavaScript sandbox to execute arbitrary code on the system. An attacker who can control the contents of the template document is able to execute arbitrary code on the system. By default, only users with the `admin` role are able to create or update templates. Commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 patches the issue.
Weakness: CWE-1336
Which versions are affected by CVE-2024-55652?
How do I fix CVE-2024-55652?
No fix has been published for CVE-2024-55652 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-55652 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-55652 exists.
Sources
Also known as GHSA-jw5r-6927-hwpc.