GHSA-w47q-945m-q9pc: High severity pip/document-merge-service vulnerability
Impact A remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container. The vulnerability is limited to XLSX templates, were the xltpl library uses a npn-sandboxed Jinja environment for the processing of the template.
Patches It has been patched in v9.1.0
Workarounds Disable the upload/usage of XLSX templates.
References Are there any links users can visit to find out more?
https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection/jinja2-ssti
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/document-merge-serviceto a version that resolves this vulnerability.Fixed in 9.1.0 - Upgrade
Upgrade
document-merge-serviceto a version that resolves this vulnerability.Fixed in v9.1.0 - Configuration
Disable the upload/usage of XLSX templates to mitigate the SSTI RCE vulnerability limited to XLSX templates.
document-merge-service upload/usage of XLSX templates = disabled
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments that process XLSX templates are affected, because XLSX template handling uses the xltpl library with a non-sandboxed Jinja environment. The issue does not apply to template types not described as using this XLSX processing path.
What access does an attacker need to exploit it?
An attacker needs a way to supply code through an XLSX template that the service processes. Successful exploitation executes that code remotely in the server context as the document-merge-server user, UID 901.
What should we do if upgrading is not immediately possible?
Disable the upload and use of XLSX templates until the service can be updated. The advisory identifies version 9.1.0 as containing the patch.