CVE-2022-24442 PoC — JetBrains YouTrack 代码注入漏洞

Description

CVE-2022-24442: FreeMarker Server-Side Template Injection in JetBrains YouTrack

介绍

# CVE-2022-24442: FreeMarker Server-Side Template Injection in JetBrains YouTrack

By inserting malicious content in the Notification FTL files, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and obtain RCE (Remote Code Execution).

<strong>Note:</strong> This issue exists because of an incomplete fix for CVE-2021-25770.

### Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found [here](https://www.jetbrains.com/privacy-security/issues-fixed/).

### Requirements:

This vulnerability requires:
<br/>
- Valid user credentials

### Proof Of Concept:

More details and the exploitation process can be found in this [PDF](https://github.com/mbadanoiu/CVE-2022-24442/blob/main/YouTrack%20-%20CVE-2022-24442.pdf).

### Additional Resources:

[Awesome article](https://www.synacktiv.com/publications/exploiting-cve-2021-25770-a-server-side-template-injection-in-youtrack) by [Vincent Herbulot of Synacktiv](https://www.synacktiv.com/en/our-team/pentest) that inspired the finding of this vulnerability.

Initial vulnerability [CVE-2021-25770](https://nvd.nist.gov/vuln/detail/CVE-2021-25770) discovered by Vasily Vasilkov.

文件快照

备注