Summary
WeRSS through version 1.5.3 contains a server-side code injection vulnerability in the template handling of its public RSS endpoint. An unauthenticated attacker may supply a crafted template that bypasses expression restrictions and execute operating-system commands with the privileges of the WeRSS service.
WeRSS through version 1.5.3 contains a server-side code injection vulnerability in the template handling of its public RSS endpoint. An unauthenticated attacker may supply a crafted template that bypasses expression restrictions and execute operating-system commands with the privileges of the WeRSS service.
Affected context
The issue occurs in WeRSS deployments that expose the public GET /rss/{feed_id} endpoint and process attacker-influenced template parameters. Risk increases when the endpoint accepts non-built-in template extensions and evaluates template expressions using an incomplete denylist or otherwise insufficient execution isolation.
The issue occurs in WeRSS deployments that expose the public GET /rss/{feed_id} endpoint and process attacker-influenced template parameters. Risk increases when the endpoint accepts non-built-in template extensions and evaluates template expressions using an incomplete denylist or otherwise insufficient execution isolation.
Exploit preconditions
- Attack surface: Public HTTP RSS endpoint
- Required access: No authentication may be required when the endpoint is exposed
- Trigger point: Server-side processing of the template parameter for an RSS feed request
- Why exploitation is possible: User-controlled template expressions are evaluated in a context where denylist checks can be bypassed, allowing access to command-execution functionality
- Attack surface: Public HTTP RSS endpoint
- Required access: No authentication may be required when the endpoint is exposed
- Trigger point: Server-side processing of the template parameter for an RSS feed request
- Why exploitation is possible: User-controlled template expressions are evaluated in a context where denylist checks can be bypassed, allowing access to command-execution functionality
Why this happens
The vulnerability results from evaluating attacker-controlled template content as executable logic. The template engine relies on denylist-based restrictions that do not adequately constrain object access or expression evaluation, allowing internal language features to be reached indirectly.
This behavior maps to CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Code Injection'), because input intended to define presentation content is interpreted as executable code rather than treated strictly as data.
The vulnerability results from evaluating attacker-controlled template content as executable logic. The template engine relies on denylist-based restrictions that do not adequately constrain object access or expression evaluation, allowing internal language features to be reached indirectly.
This behavior maps to CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Code Injection'), because input intended to define presentation content is interpreted as executable code rather than treated strictly as data.
Potential impact
- An attacker may execute arbitrary operating-system commands
- The WeRSS service account could be compromised
- Sensitive application data and environment secrets could be exposed
- The host or container could be altered or used for persistence
- The compromised service could support lateral movement or further attacks
- An attacker may execute arbitrary operating-system commands
- The WeRSS service account could be compromised
- Sensitive application data and environment secrets could be exposed
- The host or container could be altered or used for persistence
- The compromised service could support lateral movement or further attacks
General mitigation guidance
Mitigation generally focuses on preventing untrusted template content from reaching dynamic evaluation.
Common defensive patterns include:
- Treating templates and expressions as untrusted data by default
- Replacing general-purpose evaluation with a constrained rendering model or fixed template set
- Using allowlists for permitted fields, functions, and template constructs
- Removing access to reflection, object traversal, filesystem, and process APIs from rendering contexts
- Applying strict input validation to template-related parameters and extension values
- Running the service with least-privilege permissions and isolating it from sensitive host resources
- Avoiding reliance on denylist-only filtering as the primary security boundary
Mitigation generally focuses on preventing untrusted template content from reaching dynamic evaluation.
Common defensive patterns include:
- Treating templates and expressions as untrusted data by default
- Replacing general-purpose evaluation with a constrained rendering model or fixed template set
- Using allowlists for permitted fields, functions, and template constructs
- Removing access to reflection, object traversal, filesystem, and process APIs from rendering contexts
- Applying strict input validation to template-related parameters and extension values
- Running the service with least-privilege permissions and isolating it from sensitive host resources
- Avoiding reliance on denylist-only filtering as the primary security boundary
How teams detect issues like this
Organizations can look for this issue through:
- Static analysis rules identifying dynamic evaluation in template-rendering paths
- Code review checks for denylist-based sandboxing and unrestricted object traversal
- Tests that submit unexpected template syntax and verify that it is treated as data
- API policy checks ensuring public endpoints do not accept arbitrary rendering instructions
- Runtime monitoring for unusual child processes, shell activity, or command execution by the WeRSS service account
- Automated security review tools that flag expression evaluation and template injection patterns
Organizations can look for this issue through:
- Static analysis rules identifying dynamic evaluation in template-rendering paths
- Code review checks for denylist-based sandboxing and unrestricted object traversal
- Tests that submit unexpected template syntax and verify that it is treated as data
- API policy checks ensuring public endpoints do not accept arbitrary rendering instructions
- Runtime monitoring for unusual child processes, shell activity, or command execution by the WeRSS service account
- Automated security review tools that flag expression evaluation and template injection patterns
