Code Execution Vulnerability in StackStorm by StackStorm Technologies
CVE-2021-44657

8.8HIGH

Key Information:

Vendor

Stackstorm

Status
Stackstorm
Vendor
CVE Published:
15 December 2021

What is CVE-2021-44657?

In versions of StackStorm prior to 3.6.0, the Jinja interpreter was not executed in sandbox mode. This configuration flaw allowed attackers to execute unsafe system commands, posing significant security risks. To enhance security, StackStorm has now made sandbox mode the default for Jinja to mitigate this vulnerability.

References

https://github.com/StackStorm/st2/pull/5359
x_refsource_MISC
https://podalirius.net/en/articles/python-vulnerabilities...
x_refsource_MISC
https://github.com/pallets/jinja/issues/549
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.