CVE-2024-38363CWE-1336

Remote Code Execution (RCE) via Server Side Template Injection (SSTI) in Airbyte

High · published July 9, 2024

CVSS v3.1
8.6
EPSS
1%
Percentile
51.3
In the wild
Unconfirmed
What it is

Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated remote attacker to execute arbitrary code on the server as the web server user. The connection builder is used to create and test new connectors. Sensitive information, such as credentials, could be exposed if a user tested a new connector on a compromised instance. The connection builder does not have access to any data processes. This vulnerability is fixed in 0.62.2.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00669 · 51.3th percentile
Weakness
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine
Published
2024-07-09T14:10Z
EPSS history
Timeline
  • 09 JUL 14:10Z
    Remote Code Execution (RCE) via Server Side Template Injection (SSTI) in Airbyte
    cvelistv5