LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>

Summary

LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query-string values or 'content' data to /knowledge/render/<ID> to reach Python builtins and execute operating system commands as the web application account.

Remediation

1. Inventory every LMFDB LMFDB deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Patchhttps://github.com/LMFDB/lmfdb/pull/7231
• Patchhttps://github.com/LMFDB/lmfdb/commit/01829bd09b692c720aad30c952758a20630573d4
• Advisoryhttps://github.com/LMFDB/lmfdb/security/advisories/GHSA-6jw3-pmcx-2xww
• Advisoryhttps://www.vulncheck.com/advisories/lmfdb-before-commit-01829bd-unauthenticated-server-side-template-injection-via-knowledge-render-id
• Referencehttps://github.com/LMFDB/lmfdb/blob/c6e5bac205aa12de9edf584a06328fefa81de0de/lmfdb/knowledge/main.py#L747