Summary

There is a Server Side Template Injection vulnerability that leads to Remote Code Execution in Peering Manager <=1.8.2.

Impact

Arbitrary commands can be executed on the operating system that is running Peering Manager.

Suggestions

• Update to version 1.8.3 where a sandbox is used for jinja templates.
• As now mentioned in the documentation, sandboxing is not a guaranteed protection. Always check any code before using it in your instance.

Further References

• https://docs.peering-manager.net/templating/
• https://docs.cobalt.io/bestpractices/prevent-ssti/
• https://stackoverflow.com/questions/73939573/how-to-sanitise-string-of-python-code-with-python