https://github.com/mbadanoiu/cve-2022-24442
CVE-2022-24442: FreeMarker Server-Side Template Injection in JetBrains YouTrack
https://github.com/mbadanoiu/cve-2022-24442
0-day authenticated bypass cve cve-2021-25770 cve-2022-24442 cves remote-code-execution server-side-template-injection
Last synced: about 2 months ago
JSON representation
CVE-2022-24442: FreeMarker Server-Side Template Injection in JetBrains YouTrack
- Host: GitHub
- URL: https://github.com/mbadanoiu/cve-2022-24442
- Owner: mbadanoiu
- Created: 2024-01-05T00:04:41.000Z (over 1 year ago)
- Default Branch: main
- Last Pushed: 2024-01-05T00:21:20.000Z (over 1 year ago)
- Last Synced: 2025-01-12T09:29:31.086Z (4 months ago)
- Topics: 0-day, authenticated, bypass, cve, cve-2021-25770, cve-2022-24442, cves, remote-code-execution, server-side-template-injection
- Homepage:
- Size: 3.24 MB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# CVE-2022-24442: FreeMarker Server-Side Template Injection in JetBrains YouTrack
By inserting malicious content in the Notification FTL files, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and obtain RCE (Remote Code Execution).
Note: This issue exists because of an incomplete fix for CVE-2021-25770.
### Vendor Disclosure:
The vendor's disclosure and fix for this vulnerability can be found [here](https://www.jetbrains.com/privacy-security/issues-fixed/).
### Requirements:
This vulnerability requires:
- Valid user credentials
### Proof Of Concept:
More details and the exploitation process can be found in this [PDF](https://github.com/mbadanoiu/CVE-2022-24442/blob/main/YouTrack%20-%20CVE-2022-24442.pdf).
### Additional Resources:
[Awesome article](https://www.synacktiv.com/publications/exploiting-cve-2021-25770-a-server-side-template-injection-in-youtrack) by [Vincent Herbulot of Synacktiv](https://www.synacktiv.com/en/our-team/pentest) that inspired the finding of this vulnerability.
Initial vulnerability [CVE-2021-25770](https://nvd.nist.gov/vuln/detail/CVE-2021-25770) discovered by Vasily Vasilkov.