CVE-2024-37301: document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection

June 11, 2024 (updated October 16, 2024)

A remote code execution (RCE) via server-side template injection (SSTI) allows for user supplied code to be executed in the server’s context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker considerable control over the container.

References

github.com/adfinis/document-merge-service
github.com/adfinis/document-merge-service/commit/a1edd39d33d1bdf75c31ea01c317547be90ca074
github.com/adfinis/document-merge-service/security/advisories/GHSA-v5gf-r78h-55q6
github.com/advisories/GHSA-v5gf-r78h-55q6
nvd.nist.gov/vuln/detail/CVE-2024-37301

Code Behaviors & Features

Detect and mitigate CVE-2024-37301 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →