Appsmith Remote Command Execution Vulnerability via Misconfigured PostgreSQL in Docker Container

A remote command execution vulnerability has been identified in Appsmith versions through 1.50. The issue arises from an incorrectly configured PostgreSQL instance in the Appsmith Docker image, allowing attackers to execute commands within the Appsmith container. To exploit this vulnerability, an attacker must access Appsmith, log in, create a datasource, formulate a query against that datasource, and execute the query.

Impact

Exploitation of this vulnerability allows for remote command execution within the Appsmith Docker container, as well as potential information disclosure.

Remediation

Users can upgrade to Appsmith version 1.52 or later to address this vulnerability. Alternatively, the embedded PostgreSQL database can be disabled by setting 'APPSMITH_ENABLE_EMBEDDED_DB=0' in the container's environment.