CVE-2025-66434
📋 TL;DR
An authenticated attacker with Dunning Type configuration access can exploit this Server-Side Template Injection vulnerability in Frappe ERPNext to execute arbitrary Jinja2 expressions. This allows server-side code execution within a restricted but unsafe context, potentially leading to database information leakage. The vulnerability affects all Frappe ERPNext instances up to version 15.89.0.
💻 Affected Systems
- Frappe ERPNext
📦 What is this software?
Erpnext by Frappe
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise, data exfiltration, and potential lateral movement within the ERP system
Likely Case
Unauthorized database queries leading to sensitive data exposure and potential privilege escalation
If Mitigated
Limited impact due to restricted user permissions and network segmentation
🎯 Exploit Status
Exploitation requires authenticated access to specific configuration areas
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 15.90.0 or later
Vendor Advisory: https://github.com/frappe/erpnext/security/advisories
Restart Required: Yes
Instructions:
1. Update Frappe ERPNext to version 15.90.0 or later
2. Restart the application server
3. Verify the patch is applied by checking the version
🔧 Temporary Workarounds
Restrict Dunning Type Configuration Access
allLimit user permissions to only essential personnel for Dunning Type and Dunning Letter Text configuration
Implement WAF Rules
allDeploy web application firewall rules to detect and block Jinja2 template injection attempts
🧯 If You Can't Patch
- Implement strict access controls to limit Dunning Type configuration to trusted administrators only
- Monitor application logs for suspicious template rendering activities and unusual database queries
🔍 How to Verify
Check if Vulnerable:
Check if Frappe ERPNext version is 15.89.0 or earlier and verify user has Dunning Type configuration accessCheck Version:
bench versionVerify Fix Applied:
Confirm version is 15.90.0 or later and test that Jinja2 expressions in Dunning Letter Text are properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual Jinja2 template rendering in get_dunning_letter_text method
- Suspicious database queries from template rendering context
- Multiple failed template rendering attempts
Network Indicators:
- Unusual outbound database connections from ERPNext server
- Large data transfers following template configuration changes
SIEM Query:
source="erpnext" AND ("get_dunning_letter_text" OR "frappe.render_template") AND (error OR exception OR "template injection")