Description
WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
rachelos we-mp-rss
Default version status: unaffected
0 to ≤ 1.5.3affected
pkg:github/rachelos/we-mp-rssReferences
- https://hackmd.io/@hieuPenguinnn/werss-rss-template-unauth-ssti-rce ↗
- https://github.com/rachelos/we-mp-rss/blob/v1.5.3/core/lax/template_parser.py#L1150-L1166 ↗
- https://github.com/rachelos/we-mp-rss/blob/v1.5.3/apis/rss.py#L185-L198 ↗
- https://www.vulncheck.com/advisories/werss-we-mp-rss-through-1.5.3-rce-via-template-parameter-in-rss-endpoint ↗