CVE-2024-25624

Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. Due to an improper setup of Jinja2 environment, reports generation in `iris-web` is prone to a Server Side Template Injection (SSTI). Successful exploitation of the vulnerability can lead to an arbitrary Remote Code Execution. An authenticated administrator has to upload a crafted report template containing the payload. Upon generation of a report based on the weaponized report, any user can trigger the vulnerability. The vulnerability is patched in IRIS v2.4.6. No workaround is available. It is recommended to update as soon as possible. Until patching, review the report templates and keep the administrative privileges that include the upload of report templates limited to dedicated users.

• CWE-1336
• CWE-94

• https://github.com/dfir-iris/iris-web/security/advisories/GHSA-m64w-f7fg-hpcrVendor Advisory
• https://github.com/dfir-iris/iris-web/security/advisories/GHSA-m64w-f7fg-hpcrVendor Advisory

Published

Apr 25, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-25619Mastodon is a free, open-source social network server based …4.3
• CVE-2024-2562A vulnerability, which was classified as critical, was found…9.8
• CVE-2024-25620Helm is a tool for managing Charts. Charts are packages of p…6.4
• CVE-2024-25621containerd is an open-source container runtime. Versions 0.1…7.8
• CVE-2024-25622h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and …4.3
• CVE-2024-25623Mastodon is a free, open-source social network server based …7.7
• CVE-2024-25625Pimcore's Admin Classic Bundle provides a Backend UI for Pim…9.3
• CVE-2024-25626Yocto Project is an open source collaboration project that h…9.8
• CVE-2024-25627Alf.io is a free and open source event attendance management…4.8
• CVE-2024-25628Alf.io is a free and open source event attendance management…7.6
• CVE-2024-25629c-ares is a C library for asynchronous DNS requests. `ares__…5.5
• CVE-2024-2563A vulnerability has been found in PandaXGO PandaX up to 2024…9.8