Description
A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor replies, that "[t]he fix will come within upcoming release (v4.2) and will be inherited by maintenance releases of LTS versions (starting 4.0)."
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ThingsBoard | 4.1 | — |
References
- VDB-320416 | ThingsBoard Add Gateway special elements used in a template engine vdb-entry
- VDB-320416 | CTI Indicators (IOB, IOC, TTP) signature permissions-required
- Submit #626292 | ThingsBoard ThingsBoard IoT Platform 4.1.0 Stored Client-Side Template Injection (CSTI) third-party-advisory
- https://drive.google.com/file/d/1cZy-rfQXsF58kJIVs4UXj7usXJuhjZjA/view broken-link exploit