https://github.com/mbadanoiu/cve-2021-46362

CVE-2021-46362: FreeMarker Server-Side Template Injection in Magnolia CMS
https://github.com/mbadanoiu/cve-2021-46362

0-day cve cve-2021-46362 cves server-side-template-injection unauthenticated

Last synced: 2 days ago
JSON representation

CVE-2021-46362: FreeMarker Server-Side Template Injection in Magnolia CMS

• Host: GitHub
• URL: https://github.com/mbadanoiu/cve-2021-46362
• Owner: mbadanoiu
• Created: 2024-02-13T18:08:02.000Z (9 months ago)
• Default Branch: main
• Last Pushed: 2024-02-14T08:37:24.000Z (9 months ago)
• Last Synced: 2024-02-14T10:38:42.300Z (9 months ago)
• Topics: 0-day, cve, cve-2021-46362, cves, server-side-template-injection, unauthenticated
• Homepage:
• Size: 682 KB
• Stars: 0
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# CVE-2021-46362: FreeMarker Server-Side Template Injection in Magnolia CMS

A Server-Side Template Injection (SSTI) vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows unauthenticated attackers to execute arbitrary code via a crafted payload entered into the fullname parameter.

### Collaboration:

This vulnerability was found in collaboration with Marian-Razvan Ilisanu.

### Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found [here](https://docs.magnolia-cms.com/product-docs/6.2/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#_security_advisory).

### Proof Of Concept:

More details and the exploitation process can be found in this [PDF](https://github.com/mbadanoiu/CVE-2021-46362/blob/main/Magnolia%20CMS%20-%20CVE-2021-46362.pdf).