by Kastro
Paper/Archive/CVE-2024-7093

CVE-2024-7093

Netflix Dispatch — Server-Side Template Injection in Dispatch Message Templates

EPSS 0.5%CVSS 9.4
critical.is priorityof 100
37
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 43.4.434 × 208.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Dispatch's notification service uses Jinja templates to generate messages to users. Jinja permits code execution within blocks, which were neither properly sanitized nor sandboxed. This vulnerability enables users to construct command line scripts in their custom message templates, which are then executed whenever these notifications are rendered and sent out.

Affected

ProductAffectedFixed inSource
Dispatch< v20240731v20240731CNA
dispatch< 2024073120240731CISA-ADP

Scores by source

netflix (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/Netflix/security-bulletins/blob/master/advisories/nflx-2024-003.md