Vulnerability · Published Aug 1, 2024 · Assigned by netflix

CVE-2024-7093Server-Side Template Injection in Dispatch Message Templates

Critical 9.4

In plain English

A critical-severity code injection in Dispatch from Netflix. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)0.5%top 56.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Dispatch's notification service uses Jinja templates to generate messages to users. Jinja permits code execution within blocks, which were neither properly sanitized nor sandboxed. This vulnerability enables users to construct command line scripts in their custom message templates, which are then executed whenever these notifications are rendered and sent out.

Affected products (as reported)

Vendor	Product	Versions
Netflix	Dispatch	0 – before v20240731

Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2024-003.md