Amidaware Tactical RMM Server-Side Template Injection Vulnerability Allowing Remote Command Execution

A Server-Side Template Injection (SSTI) vulnerability has been identified in Amidaware Tactical RMM versions through 1.3.1. This vulnerability allows low-privileged users with Report Viewer or Report Manager permissions to execute remote commands on the server. The issue arises in the '/reporting/templates/preview/' endpoint, where improper sanitization of the 'template_md' parameter enables direct injection of Jinja2 templates. Exploitation is made possible by the misuse of the 'generate_html()' function, which inserts user-controlled values into 'env.from_string', allowing arbitrary processing of Jinja2 templates.

Impact

Exploitation of this vulnerability could lead to unauthorized remote command execution on the server, potentially compromising the entire system.

Remediation

Users are advised to update to version 1.4.0.