CVE-2025-66437
📋 TL;DR
This CVE describes a Server-Side Template Injection (SSTI) vulnerability in Frappe ERPNext that allows authenticated attackers with Address Template permissions to execute arbitrary Jinja expressions. This can lead to server-side code execution or database information disclosure. The vulnerability affects all ERPNext instances through version 15.89.0.
💻 Affected Systems
- Frappe ERPNext
📦 What is this software?
Erpnext by Frappe
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise leading to data exfiltration, ransomware deployment, or complete system takeover via remote code execution.
Likely Case
Database information disclosure including sensitive business data, customer information, and potentially credential extraction.
If Mitigated
Limited impact if proper authentication controls and template validation are in place, but still significant risk.
🎯 Exploit Status
Exploitation requires authenticated access and specific permissions, but detailed technical analysis is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 15.90.0 or later
Vendor Advisory: https://github.com/frappe/frappe/security/advisories
Restart Required: Yes
Instructions:
1. Update Frappe ERPNext to version 15.90.0 or later. 2. Restart the application server. 3. Verify the patch is applied by checking the version.
🔧 Temporary Workarounds
Restrict Address Template Permissions
allLimit which users can create or modify Address Templates to only trusted administrators.
Input Validation for Template Fields
allImplement strict validation on template field inputs to block Jinja expression injection.
🧯 If You Can't Patch
- Implement strict access controls to limit who can create or modify Address Templates.
- Deploy a WAF with rules to detect and block SSTI payloads in template fields.
🔍 How to Verify
Check if Vulnerable:
Check if ERPNext version is 15.89.0 or earlier and if users have Address Template modification permissions.Check Version:
bench versionVerify Fix Applied:
Verify ERPNext version is 15.90.0 or later and test that Jinja expressions in Address Templates are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual template modifications
- Multiple failed template validation attempts
- Suspicious API calls to get_address_display
Network Indicators:
- Unusual patterns in template-related API traffic
- Payloads containing Jinja expressions in POST requests
SIEM Query:
source="erpnext" AND (event="template_modification" OR api_call="get_address_display") AND payload CONTAINS "{{%"