ZDI-CAN-23609: ZDI-24-1165: Allegra getLinkText Server-Side Template Injection Remote Code Execution Vulnerability

Published Aug 22, 2024

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of getLinkText method. The issue results from the lack of proper validation of a user-supplied string before processing it with the template engine. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE.

Other sources

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2024-30372.

— ZDI

Affected Software

1 affected component

Allegra Allegra

Event History

Aug 22, 2024

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Feb 21, 2025

Advisory Published

via ZDI·08:51 AM

Frequently Asked Questions

What is the severity of ZDI-CAN-23609?

The severity of ZDI-CAN-23609 is critical due to the potential for remote code execution.

How do I fix ZDI-CAN-23609?

To fix ZDI-CAN-23609, ensure that you update Allegra to the latest version that addresses this vulnerability.

What versions of Allegra are affected by ZDI-CAN-23609?

ZDI-CAN-23609 affects all installations of Allegra that have not been patched against this vulnerability.

Is authentication required to exploit ZDI-CAN-23609?

Yes, authentication is required to exploit ZDI-CAN-23609.

What is the impact of ZDI-CAN-23609 on affected systems?

The impact of ZDI-CAN-23609 on affected systems includes the ability for remote attackers to execute arbitrary code.