LMFDB knowledge rendering flaw allows unauthenticated remote code execution
Anyone without a login can take control of the LMFDB web server!
Summary
A server-side template injection flaw in LMFDB's knowledge rendering lets an unauthenticated attacker run operating system commands as the web application account. Versions before commit 01829bd are affected.
Affected when
- Versions before commit 01829bd
What to do
Update to code from commit 01829bd09b692c720aad30c952758a20630573d4 or later. If you run it yourself, check that you have the fixed code.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab)
- Write-up: github.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen