CVE-2025-66438
📋 TL;DR
This Server-Side Template Injection (SSTI) vulnerability in Frappe ERPNext allows authenticated attackers with Print Format creation/modification permissions to inject malicious Jinja expressions that execute database queries when Print Formats are rendered. This leads to sensitive database information disclosure including schema details and potentially sensitive data. All ERPNext instances up to version 15.89.0 are affected.
💻 Affected Systems
- Frappe ERPNext
📦 What is this software?
Erpnext by Frappe
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including extraction of sensitive business data, user credentials, and potential privilege escalation through further exploitation of disclosed information.
Likely Case
Information disclosure of database schema, version details, and potentially sensitive business data from accessible tables.
If Mitigated
Limited impact with proper access controls restricting Print Format permissions to trusted users only.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once an attacker has Print Format permissions. Public proof-of-concept demonstrates the attack flow.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 15.90.0 or later
Vendor Advisory: https://github.com/frappe/frappe/security/advisories
Restart Required: Yes
Instructions:
1. Update Frappe framework to version 15.90.0 or later. 2. Update ERPNext to latest compatible version. 3. Restart the application server. 4. Verify the fix by checking version and testing Print Format functionality.
🔧 Temporary Workarounds
Restrict Print Format Permissions
allLimit Print Format creation and modification permissions to only essential, trusted users.
Disable Print Format API
allTemporarily disable the frappe.www.printview.get_html_and_style() API endpoint if not required.
🧯 If You Can't Patch
- Implement strict access controls to limit Print Format permissions to minimal necessary users
- Monitor and audit Print Format creation/modification activities for suspicious patterns
🔍 How to Verify
Check if Vulnerable:
Check if ERPNext version is 15.89.0 or earlier. Review user permissions for Print Format creation/modification.Check Version:
bench versionVerify Fix Applied:
Verify ERPNext version is 15.90.0 or later. Test Print Format rendering with safe templates.📡 Detection & Monitoring
Log Indicators:
- Unusual Print Format creation/modification by non-admin users
- Multiple failed or unusual database queries from Print Format rendering
Network Indicators:
- Unusual API calls to frappe.www.printview.get_html_and_style() endpoint
SIEM Query:
source="erpnext" AND (event="Print Format Created" OR event="Print Format Modified") AND user!="Administrator"