CVE-2025-35113
📋 TL;DR
Agiloft Release 28 contains a template injection vulnerability in its EUI template engine that allows authenticated attackers to execute arbitrary code remotely. This affects all users running Agiloft Release 28 who have authenticated access to the system. Attackers can craft malicious payloads that get executed when processed by the template engine.
💻 Affected Systems
- Agiloft
📦 What is this software?
Agiloft by Atlassian
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attacker to execute arbitrary commands, access sensitive data, pivot to other systems, and maintain persistent access.
Likely Case
Attacker gains shell access on the Agiloft server, potentially accessing database contents, configuration files, and other sensitive information stored on the system.
If Mitigated
With proper network segmentation and least privilege access, impact limited to the Agiloft application server only.
🎯 Exploit Status
Exploitation requires authenticated access and knowledge of template injection techniques. No public exploit code available at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Release 31
Vendor Advisory: https://wiki.agiloft.com/display/HELP/What%27s+New%3A+CVE+Resolution
Restart Required: No
Instructions:
1. Backup current Agiloft installation and database. 2. Download Agiloft Release 31 from official vendor sources. 3. Follow Agiloft upgrade documentation to migrate from Release 28 to Release 31. 4. Verify successful upgrade and functionality.
🔧 Temporary Workarounds
Restrict authenticated access
allLimit user accounts to only essential personnel and implement strong authentication controls
Network segmentation
allIsolate Agiloft servers from critical infrastructure and implement strict firewall rules
🧯 If You Can't Patch
- Implement strict access controls and monitor all authenticated user activity
- Deploy web application firewall with template injection protection rules
🔍 How to Verify
Check if Vulnerable:
Check Agiloft version in admin interface or via system information page. If version is Release 28, system is vulnerable.Check Version:
Check Agiloft admin dashboard → System Information → VersionVerify Fix Applied:
After upgrade, verify version shows Release 31 in admin interface and test template functionality works normally.📡 Detection & Monitoring
Log Indicators:
- Unusual template processing errors
- Suspicious user activity patterns
- Unexpected system command execution in logs
Network Indicators:
- Unusual outbound connections from Agiloft server
- Suspicious payloads in HTTP requests to template endpoints
SIEM Query:
source="agiloft" AND (event_type="template_error" OR event_type="system_command")