CVE-2025-66438

{"id": "CVE-2025-66438", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66438", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-16T14:55:58.539106Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-15T18:15:48.410", "references": [{"url": "https://iamanc.github.io/post/erpnext-ssti-bug-5", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.notion.so/SSTI-bug-5-239e6086eadc80a48f17c1257a604d2c?source=copy_link", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-1336"}]}], "descriptions": [{"lang": "en", "value": "A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism. Specifically, the API frappe.www.printview.get_html_and_style() triggers the rendering of the html field inside a Print Format document using frappe.render_template(template, doc) via the get_rendered_template() call chain. Although ERPNext wraps Jinja2 in a SandboxedEnvironment, it exposes sensitive functions such as frappe.db.sql through get_safe_globals(). An authenticated attacker with permission to create or modify a Print Format can inject arbitrary Jinja expressions into the html field. Once the malicious Print Format is saved, the attacker can call get_html_and_style() with a target document (e.g., Supplier or Sales Invoice) to trigger the render process. This leads to information disclosure from the database, such as database version, schema details, or sensitive values, depending on the injected payload. Exploitation flow: Create a Print Format with SSTI payload in the html field; call the get_html_and_style() API; triggers frappe.render_template(template, doc) inside get_rendered_template(); leaks database information via frappe.db.sql or other exposed globals."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n de plantillas del lado del servidor (SSTI) existe en el mecanismo de renderizado de formato de impresi\u00f3n de Frappe ERPNext hasta la versi\u00f3n 15.89.0. Espec\u00edficamente, la API frappe.www.printview.get_html_and_style() activa el renderizado del campo html dentro de un documento de formato de impresi\u00f3n usando frappe.render_template(template, doc) a trav\u00e9s de la cadena de llamadas get_rendered_template(). Aunque ERPNext envuelve Jinja2 en un SandboxedEnvironment, expone funciones sensibles como frappe.db.sql a trav\u00e9s de get_safe_globals(). Un atacante autenticado con permiso para crear o modificar un formato de impresi\u00f3n puede inyectar expresiones Jinja arbitrarias en el campo html. Una vez que se guarda el formato de impresi\u00f3n malicioso, el atacante puede llamar a get_html_and_style() con un documento objetivo (por ejemplo, Proveedor o Factura de Venta) para activar el proceso de renderizado. Esto lleva a la revelaci\u00f3n de informaci\u00f3n de la base de datos, como la versi\u00f3n de la base de datos, detalles del esquema o valores sensibles, dependiendo de la carga \u00fatil inyectada. Flujo de explotaci\u00f3n: Crear un formato de impresi\u00f3n con carga \u00fatil SSTI en el campo html; llamar a la API get_html_and_style(); activa frappe.render_template(template, doc) dentro de get_rendered_template(); filtra informaci\u00f3n de la base de datos a trav\u00e9s de frappe.db.sql u otras globales expuestas."}], "lastModified": "2026-10-14T13:10:00.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DAA2FB4F-48C5-4BA5-A15F-175B8A752866", "versionEndIncluding": "15.89.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}