Remote Code Execution via SSTI in Cachet

Cachet versions 2.4.1 and earlier contain a server-side template injection (SSTI) vulnerability during the processing of incident templates. The application fails to properly sanitize user-supplied input when rendering these templates, which rely on the Blade templating engine or Twig filters. An authenticated user with sufficient permissions to create or modify incident templates can inject malicious syntax that is subsequently executed by the application's template engine. This allows an attacker to execute arbitrary PHP code under the context of the web server process, potentially leading to a full system compromise. The vulnerability is critical for organizations that allow users with incident management roles to modify global or incident-specific templates.

Impact

Successful exploitation allows for arbitrary remote code execution on the server hosting the Cachet instance. This can lead to complete loss of confidentiality, integrity, and availability of the application and the underlying server. Impact includes potential unauthorized data access, lateral movement within the network, and the deployment of persistent backdoors.

Recommendation

• Upgrade Cachet instances to the latest available patched version to remediate the vulnerability.
• Review all incident templates for unauthorized modifications, specifically looking for Blade or Twig directives, such as {{ }} or {!! !!}, that contain non-standard PHP functions.
• Restrict the ability to create and modify incident templates to highly trusted administrative accounts only.
• Implement web application firewall (WAF) rules to inspect POST requests directed at template management endpoints for common template injection characters and strings.