CVE-2023-1304

HIGH

Rapid7 InsightCloudSec < 2023.02.01 & InsightAppSec < 23.2.1 - RCE via Jinja Template Injection

Title source: llm
STIX 2.1

Description

An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.

References (2)

Core 2
Core References
Exploit, Third Party Advisory third-party-advisory
https://nephosec.com/exploiting-rapid7s-insightcloudsec/

Scores

CVSS v3 8.8
EPSS 0.0108
EPSS Percentile 60.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-94
Status published
Products (2)
rapid7/insightappsec < 23.2.1
rapid7/insightcloudsec < 2023.02.01 (2 CPE variants)
Published Mar 21, 2023
Tracked Since Feb 18, 2026