CVE-2023-45303

Vulnerability

Overview

The vulnerability is a server-side template injection (SSTI) in ThingsBoard versions prior to 3.5. Applications using Apache FreeMarker for email template processing are affected because FreeMarker supports the freemarker.template.utility.Execute class, which can run external commands [1]. An attacker with permission to modify email templates can inject malicious FreeMarker directives into the template content, which is then rendered and executed server-side when an email is sent [2].

Exploitation

Exploitation requires an authenticated user with administrative privileges to modify email templates via the /api/admin/settings endpoint [1]. The attacker inserts a FreeMarker directive like <#assign ex="freemarker.template.utility.Execute"?new()> ${ex("command")} into the template body [2]. When the email is generated and sent, the injected directive executes the specified system command on the ThingsBoard server. This attack is possible because the application does not sanitize or restrict the use of dangerous FreeMarker built-ins in user-controlled template content [3].

Impact

Successful exploitation allows arbitrary command execution on the underlying operating system with the privileges of the ThingsBoard application process. This can lead to full compromise of the server's confidentiality, integrity, and availability, including data exfiltration, installation of persistence, or lateral movement within the network [2]. The CVSS v3 score is 7.5 (High) due to the requirement of high privileges but the potential for severe impact [2].

Mitigation and

Fix

The vendor has fixed this issue in ThingsBoard version 3.5 [1]. Users should upgrade to the patched version immediately. If upgrading is not possible, restrict administrative privileges to trusted personnel only, and ensure that email template modification permissions are tightly controlled. No official workarounds are documented, but disabling the Execute utility in FreeMarker configuration could be considered as an additional hardening measure [3].