FOSSBilling SSTI Vulnerability Leading to Unauthenticated RCE via DI Container Abuse

Vulnerability Overview A Server-Side Template Injection (SSTI) vulnerability exists within FOSSBilling's template rendering system. Administrators can inject arbitrary Twig expressions by accessing Twig templates (such as email templates, mass mail activities, custom payment adapters, and the API endpoint), leading to information disclosure and Remote Code Execution (RCE). This vulnerability resides in FOSSBilling's dependency injection container because Twig templates are rendered without a sandbox, allowing access to the full Twig environment, API context, and the application's dependency injection container. Impact Scope Information Disclosure: Templates can access sensitive data, including the , , and API global variables, which are injected into the Twig environment. This includes company settings, client data, and in specific scenarios, staff password hashes. Remote Code Execution: These API handler objects expose a method that returns the full dependency injection container, thereby allowing direct access to: - PDO – arbitrary SQL injection to overwrite the entire database (not limited to what is returned by API endpoints). - Symfony FilesystemAdapter – cache overwrites (enabling extension manifest spoofing). - Password service – password hashing (to create malicious accounts). - Session service – session manipulation. - All other registered application services. By combining this with (authorization bypass), authentication requirements are eliminated, allowing unauthenticated remote attackers to achieve full remote code execution. When this vulnerability is accessed via a custom payment gateway, the rendered template is returned directly to the paying customer; therefore, exploitation may manifest as stored cross-site scripting (client-side script execution) combined with broader SSTI and DI container abuse. Fix Solution Affected Versions: FOSSBilling versions 0.7.2 through 1.0 (all released versions) Fixed Version: 0.8.0 Detailed Information The vulnerability exists within the template rendering chain: 1. – The method uses to render arbitrary strings without sandbox restrictions. 2. – The API endpoint passes the user-supplied directly to . 3. – Email templates are rendered via , which calls passing the template content and subject. 4. – The Twig environment is configured without a sandbox, and the is enabled. 5. / – The method in API handler objects returns the raw DI container. The following variables are available in email templates: : Always available, Guest API – access to public system data. exposes the full DI container. : Available when an administrator is logged in, Admin API – full administrator access. exposes the full DI container. : Available when is set, Client API – client-specific data. exposes the full DI container. : Available when is available, raw staff data row (including passwords). : Available when is available, sanitized client array (no passwords). : Available when is available, raw admin model (including passwords). Affected Components – Email template rendering – API endpoint – Template string rendering – Mass mail activities – Custom payment adapter templates – Twig configuration – exposes the full DI container – base implementation Mitigation Measures Audit existing email templates for suspicious Twig expressions. Rotate all administrator and client API tokens. Block external access to via reverse proxies or WAFs to mitigate combined exploitation with . Credits Thanks to @Oxcan1337 for the disclosure, vulnerability analysis, and PoC. Special thanks to @Chocapikk for identifying the DI container exposure and the RCE escalation chain, and to @VadimReddySal for independently reporting this issue within custom payment gateways.

Goal Reached Thanks to every supporter — we hit 100%!

FOSSBilling SSTI Vulnerability Leading to Unauthenticated RCE via DI Container Abuse

More from this source