Executive brief
Form.io is a form and data management platform used to create and manage online forms and submissions. A server-side template injection vulnerability in the email templating service could allow an authenticated administrator to execute arbitrary code on the server by manipulating the email template configuration. This vulnerability was removed in subsequent versions after 2020.
Technical details
A server-side template injection (SSTI) vulnerability was discovered in Form.io version 2.0.0 affecting the email templating functionality (CWE-74). The vulnerability is triggered during deletion of the default email template URL, allowing an attacker to inject malicious template expressions that are executed server-side. Exploitation requires authenticated access at the administrator level and occurs during template configuration operations. A successful exploit enables remote code execution with the privileges of the server process. The vendor disputes the severity, asserting that the functionality is sandboxed and only executable by administrators. The email templating service was subsequently removed from Form.io after 2020, mitigating the vulnerability in current versions.
Affected products
- Form.io formio 2.0.0 and earlier
Timeline
- 2022-06-03: disclosed
- 2022-06-02: advisory: NVD publication