CVE-2024-7093 Server-Side Template Injection in Dispatch Message Templates
Attackers can execute arbitrary code via unsanitized Jinja templates in Dispatch notification messages, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-7093?
CVE-2024-7093 is a critical code injection vulnerability in Netflix Dispatch, published on 1 Aug 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Dispatch's notification service uses Jinja templates to generate messages to users. Jinja permits code execution within blocks, which were neither properly sanitized nor sandboxed. This vulnerability enables users to construct command line scripts in their custom message templates, which are then executed whenever these notifications are rendered and sent out.
Weakness: CWE-94
Which versions are affected by CVE-2024-7093?
How do I fix CVE-2024-7093?
No fix has been published for CVE-2024-7093 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-7093 being exploited?
There is no known exploitation of CVE-2024-7093 in the wild and no public exploit code.