CVE-2023-45303 : Security Advisory and Response

ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint).

Understanding CVE-2023-45303

This article provides insights into the CVE-2023-45303 vulnerability, its impact, technical details, and mitigation strategies.

What is CVE-2023-45303?

CVE-2023-45303 is a Server-Side Template Injection vulnerability in ThingsBoard versions prior to 3.5 that allows malicious users to exploit Apache FreeMarker functionality.

The Impact of CVE-2023-45303

The vulnerability can lead to Server-Side Template Injection, potentially compromising the confidentiality, integrity, and availability of systems running affected versions of ThingsBoard.

Technical Details of CVE-2023-45303

Vulnerability Description

The vulnerability arises from Apache FreeMarker's support for freemarker.template.utility.Execute, enabling attackers to execute arbitrary code via the /api/admin/settings endpoint.

Affected Systems and Versions

All versions of ThingsBoard before 3.5 are affected by CVE-2023-45303.

Exploitation Mechanism

Malicious users can modify email templates to trigger Server-Side Template Injection through the Apache FreeMarker utility.

Mitigation and Prevention

Immediate Steps to Take

Users are advised to update ThingsBoard to version 3.5 or newer to mitigate the CVE-2023-45303 vulnerability.

Long-Term Security Practices

Implement strict input validation and sanitize user inputs to prevent Server-Side Template Injection attacks.

Patching and Updates

Regularly check for security updates and apply patches promptly to protect systems from known vulnerabilities.