CVE-2023-43661
published 2023-10-11CVE-2023-43661: Cachet, the open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any…
PriorityP270high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
46.90%
98.7th percentile
Cachet, the open-source status page system. Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Commit 6fb043e109d2a262ce3974e863c54e9e5f5e0587 of the 2.4 branch contains a patch for this issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| all-three | cachet | < 2.4 | 2.4 |
| cachethq | cachet | < 2.4 | 2.4 |
| cachethq | cachet | >= 0 < 2.4 | 2.4 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv3.09.1CRITICALCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Cachet vulnerable to Authenticated Remote Code Execution
osv·2023-10-16
CVE-2023-43661 [CRITICAL] Cachet vulnerable to Authenticated Remote Code Execution
Cachet vulnerable to Authenticated Remote Code Execution
### Summary
A template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Within `/cachet/app/Http/Routes/ApiRoutes.php`, and attacker could control `template` input which is passed to `laravel's` dispatched handler `/cachet/app/Bus/Handlers/Commands/Incident/CreateIncidentCommandHandler.php`. If an attacker is able to control this data, they may be able to trigger a server-side template injection vulnerability which can lead to remote code execution.
This vulnerability does not exist within the [Twig](https://twig.symfony.com/) library itself, but exists during the process of the [Cachet](https://github.com/cachethq/cachet) processing
GHSA
Cachet vulnerable to Authenticated Remote Code Execution
ghsa·2023-10-16
CVE-2023-43661 [CRITICAL] CWE-74 Cachet vulnerable to Authenticated Remote Code Execution
Cachet vulnerable to Authenticated Remote Code Execution
### Summary
A template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Within `/cachet/app/Http/Routes/ApiRoutes.php`, and attacker could control `template` input which is passed to `laravel's` dispatched handler `/cachet/app/Bus/Handlers/Commands/Incident/CreateIncidentCommandHandler.php`. If an attacker is able to control this data, they may be able to trigger a server-side template injection vulnerability which can lead to remote code execution.
This vulnerability does not exist within the [Twig](https://twig.symfony.com/) library itself, but exists during the process of the [Cachet](https://github.com/cachethq/cachet) processing
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/cachethq/cachet/commit/6fb043e109d2a262ce3974e863c54e9e5f5e0587https://github.com/cachethq/cachet/security/advisories/GHSA-hv79-p62r-wg3phttps://github.com/cachethq/cachet/commit/6fb043e109d2a262ce3974e863c54e9e5f5e0587https://github.com/cachethq/cachet/security/advisories/GHSA-hv79-p62r-wg3p
2023-10-11
Published