CVE-2024-32651
Server Side Template Injection in Jinja2 allows Remote Command Execution
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Server Side Template Injection in Jinja2 allows Remote Command Execution
changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn't required by the application (not by default and not enforced).
Reserved 2024-04-16 | Published 2024-04-25 | Updated 2025-02-13 | Assigner GitHub_MCWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
github.com/...ion.io/security/advisories/GHSA-4r7v-whpg-8rx3
github.com/dgtlmoon/changedetection.io/releases/tag/0.45.21
www.onsecurity.io/...ver-side-template-injection-with-jinja2
blog.hacktivesecurity.com/...e-injection-changedetection-io/
Support options
