We Mp Rss
Monthly
Unauthenticated remote code execution in WeRSS (we-mp-rss) through 1.5.3 allows any attacker who can reach the public GET /rss/{feed_id} endpoint to run arbitrary OS commands as the service account. The flaw is a server-side template injection (CWE-95) in the template parser: by supplying a non-built-in ext value together with a {{=expression}} template, an attacker uses object-subclass traversal to bypass the eval denylist and reach command execution, with no authentication, user interaction, or non-default configuration required. Reported CVSS is 9.3 (CVSS 4.0, AV:N/AC:L/AT:N/PR:N/UI:N) and our independent assessment confirms remote, unauthenticated exploitation with high confidentiality, integrity and availability impact, rating this a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk case; no public exploit code was identified at time of analysis, though a public technical writeup of the exploitation chain and a VulnCheck advisory are referenced.
Missing authorization in the we-mp-rss export download endpoint (/api/v1/wx/tools/export/download) through version 1.5.3 lets unauthenticated remote attackers retrieve export archives stored under data/docs and, by setting delete_after_download=true, delete them - the endpoint's authentication dependency is commented out in apis/tools.py. Exploitation is not unconditional: a target archive must already exist, and the attacker must supply a valid mp_id and correctly guess the timestamp-based export filename, which is the limiting factor reflected in the assessed AT:P rating. No public exploit code identified at time of analysis; the result is unauthorized disclosure of low-sensitivity export data plus possible data loss, making this a moderate, context-dependent risk rather than a top-priority emergency.
Unauthenticated remote code execution in WeRSS (we-mp-rss) through 1.5.3 allows any attacker who can reach the public GET /rss/{feed_id} endpoint to run arbitrary OS commands as the service account. The flaw is a server-side template injection (CWE-95) in the template parser: by supplying a non-built-in ext value together with a {{=expression}} template, an attacker uses object-subclass traversal to bypass the eval denylist and reach command execution, with no authentication, user interaction, or non-default configuration required. Reported CVSS is 9.3 (CVSS 4.0, AV:N/AC:L/AT:N/PR:N/UI:N) and our independent assessment confirms remote, unauthenticated exploitation with high confidentiality, integrity and availability impact, rating this a genuine high-priority vulnerability rather than a high-CVSS-but-low-real-risk case; no public exploit code was identified at time of analysis, though a public technical writeup of the exploitation chain and a VulnCheck advisory are referenced.
Missing authorization in the we-mp-rss export download endpoint (/api/v1/wx/tools/export/download) through version 1.5.3 lets unauthenticated remote attackers retrieve export archives stored under data/docs and, by setting delete_after_download=true, delete them - the endpoint's authentication dependency is commented out in apis/tools.py. Exploitation is not unconditional: a target archive must already exist, and the attacker must supply a valid mp_id and correctly guess the timestamp-based export filename, which is the limiting factor reflected in the assessed AT:P rating. No public exploit code identified at time of analysis; the result is unauthorized disclosure of low-sensitivity export data plus possible data loss, making this a moderate, context-dependent risk rather than a top-priority emergency.