CVE-2023-30145
📋 TL;DR
Camaleon CMS v2.7.0 contains a Server-Side Template Injection vulnerability in the formats parameter that allows attackers to execute arbitrary code on the server. This affects all installations using the vulnerable version. Attackers can potentially take full control of affected systems.
💻 Affected Systems
- Camaleon CMS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, ransomware deployment, or use as a foothold for lateral movement.
Likely Case
Remote code execution allowing file system access, credential harvesting, and backdoor installation.
If Mitigated
Limited impact if proper input validation and output encoding are implemented, though template injection could still leak sensitive information.
🎯 Exploit Status
Multiple public proof-of-concept exploits exist. The vulnerability requires no authentication and has simple exploitation steps.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
Upgrade to a patched version if available, or apply workarounds. Check the official Camaleon CMS repository for updates.
🔧 Temporary Workarounds
Input Validation for formats Parameter
allImplement strict input validation to only allow expected format values
Modify application code to validate formats parameter against whitelist
WAF Rule Implementation
allDeploy web application firewall rules to block SSTI payloads
Add WAF rules to detect and block template injection patterns
🧯 If You Can't Patch
- Isolate affected systems from internet access
- Implement strict network segmentation and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Test the formats parameter with SSTI payloads like {{7*7}} and check if 49 appears in responseCheck Version:
Check Camaleon CMS version in admin panel or configuration filesVerify Fix Applied:
Retest with SSTI payloads after applying fixes to ensure they are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to formats parameter
- Template syntax in request logs
- System command execution in application logs
Network Indicators:
- HTTP requests containing template injection payloads
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND (request_uri="*formats*" AND (request_body="*{{*" OR request_body="*}}*"))🔗 References
- http://packetstormsecurity.com/files/172593/Camaleon-CMS-2.7.0-Server-Side-Template-Injection.html
- https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection
- https://drive.google.com/file/d/11MsSYqUnDRFjcwbQKJeL9Q8nWpgVYf2r/view?usp=share_link
- https://github.com/paragbagul111/CVE-2023-30145
- https://portswigger.net/research/server-side-template-injection
- http://packetstormsecurity.com/files/172593/Camaleon-CMS-2.7.0-Server-Side-Template-Injection.html
- https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection
- https://drive.google.com/file/d/11MsSYqUnDRFjcwbQKJeL9Q8nWpgVYf2r/view?usp=share_link
- https://github.com/paragbagul111/CVE-2023-30145
- https://portswigger.net/research/server-side-template-injection
