ToolJet Plugin Poisoning RCE (CVE-2025-55413) with POC and Fix Details

Vulnerability Overview Vulnerability Name: Marketplace Plugin Poisoning Enables Instance-Wide Remote Code Execution CVE ID: CVE-2025-55413 CVSS 4.0 Score: 9.9 (Critical) Affected Components: Product: ToolJet (CE and Cloud editions) Version: 3.x (tested on latest) Component: Plugin update endpoint ( , , ) Attack Chain: 1. Create malicious GitHub repository: Contains , , , and (containing malicious code). 2. List installed plugins: Retrieve UUIDs of all plugins via . 3. Override plugin: Upload the malicious plugin via . 4. Trigger execution: Create a data source and run a query using the plugin, triggering remote code execution. Impact Scope RCE: Arbitrary command execution on the ToolJet server. Supply Chain: Poisoned plugins affect all users, across all workspaces. Lateral Movement: Access to environment variables, internal networks, database credentials, etc. Stealth: The payload only executes when a query runs, with no immediate indicators. Persistence: Malicious code persists in the database until the plugin is restored or reinstalled. Remediation P0 (Immediate): 1. Restrict plugin PATCH/update permissions to instance administrators; builders should not be able to modify globally shared plugins. 2. Scope plugins by organization; add to the plugin entity. P1 (High): 3. Remove and from the VM sandbox; use (already used for workflows) instead of Node.js VM. 4. Restrict plugin repositories; accept updates only from , or verify signed manifests. P2 (Medium): 5. Add integrity checks; verify plugin code against signed hashes before execution. 6. Restrict API access; while the marketplace UI is hidden behind frontend checks in some versions, the API endpoints remain fully accessible. POC Code Key Files : PATCH endpoint, lacking additional protections. : calls + , without validation. : fetches from any GitHub repository. : stores code via . : VM execution with exposed / . : No ; plugins are global. Timeline 2025-05-24: Vulnerability discovered and confirmed. 2025-05-24: Report drafted. Root Cause Analysis 1. No authorization boundary for plugin updates: The endpoint only checks for permission, allowing any builder to modify globally shared plugins. 2. Update path bypasses installation validation: The method validates plugin files via , but the method calls , which uses , completely bypassing validation. 3. Insecure code execution sandbox: Plugin code is executed in a Node.js VM using , with and exposed. 4. No integrity verification: There are no signature, hash, or whitelist checks; any public repository URL is accepted. Impact RCE: Arbitrary command execution on the ToolJet server. Supply Chain: Poisoned plugins affect all users, across all workspaces. Lateral Movement: Access to environment variables, internal networks, database credentials, etc. Stealth: The payload only executes when a query runs, with no immediate indicators. Persistence: Malicious code persists in the database until the plugin is restored or reinstalled. Key Files : PATCH endpoint, lacking additional protections. : calls + , without validation. : fetches from any GitHub repository. : stores code via . : VM execution with exposed / . : No ; plugins are global. Remediation P0 (Immediate): 1. Restrict plugin PATCH/update permissions to instance administrators; builders should not be able to modify globally shared plugins. 2. Scope plugins by organization; add to the plugin entity. P1 (High): 3. Remove and from the VM sandbox; use (already used for workflows) instead of Node.js VM. 4. Restrict plugin repositories; accept updates only from , or verify signed manifests. P2 (Medium): 5. Add integrity checks; verify plugin code against signed hashes before execution. 6. Restrict API access; while the marketplace UI is hidden behind frontend checks in some versions, the API endpoints remain fully accessible. Timeline 2025-05-24: Vulnerability discovered and confirmed. 2025-05-24: Report drafted. Root Cause Analysis 1. No authorization boundary for plugin updates: The endpoint only checks for permission, allowing any builder to modify globally shared plugins. 2. Update path bypasses installation validation: The method validates plugin files via , but the method calls , which uses , completely bypassing validation. 3. Insecure code execution sandbox: Plugin code is executed in a Node.js VM using , with and exposed. 4. No integrity verification: There are no signature, hash, or whitelist checks; any public repository URL is accepted. Impact RCE: Arbitrary command execution on the ToolJet server. Supply Chain: Poisoned plugins affect all users, across all workspaces. Lateral Movement: Access to environment variables, internal networks, database credentials, etc. Stealth: The payload only executes when a query runs, with no immediate indicators. Persistence: Malicious code persists in the database until the plugin is restored or reinstalled. Key Files : PATCH endpoint, lacking additional protections. : calls + , without validation. : fetches from any Git

Goal Reached Thanks to every supporter — we hit 100%!

ToolJet Plugin Poisoning RCE (CVE-2025-55413) with POC and Fix Details

More from this source