dded6a86df
User-controlled template sources were rendered with the unrestricted
jinja2.Template, allowing authenticated users to achieve remote code
execution. All rendering now goes through a single shared
RenderSandboxedTemplate() helper backed by jinja2.sandbox, which denies
unsafe attribute access (e.g. __globals__, __class__) while keeping the
intended templating features working:
- POST /api/email/preview: Body and Subject (GHSA-8q4m-52pw-hfmw)
- POST /api/email/send: Body and Subject (same sink class)
- POST /api/updateWireguardConfigurationInfo (OverridePeerSettings):
values were rendered before validation, so the payload executed
before __validateOverridePeerSettings could reject it
- Peer.downloadPeer(): rendered configuration file includes raw
OverridePeerSettings values; also rendered for dashboard clients
via GetAssignedPeers
Verified: lipsum.__globals__, __class__.__mro__, TemplateReference,
cycler/joiner/namespace escape chains all raise SecurityError; normal
templates ({{ configuration.* }}, {{ peer.* }}, filters, loops) render
unchanged.
Co-authored-by: DaanSelen <80752476+DaanSelen@users.noreply.github.com>
Warning
All users running WGDashboard v4.2.x or later and hosted on the public internet are strongly advised to update to the latest release immediately. For more information: v4.3.2 Release
Tip
🎉 To help us better understand and improve WGDashboard’s performance, we’re launching the WGDashboard Testing Program. As part of this program, participants will receive free WireGuard VPN access to our server in Toronto, Canada, valid for 24 hours or up to 1GB of total traffic—whichever comes first. If you’d like to join, visit https://wg.wgdashboard.dev/ for more details!
WGDashboard
This project is supported by
Monitoring WireGuard is not convenient, in most case, you'll need to login to your server and type wg show. That's why this project is being created, to view and manage all WireGuard configurations in an easy way.
Though all these awesome features are present, we are still striving to make it easy to install and use
This project is not affiliated to the official WireGuard Project
Looking for help or want to chat about this project?
You can reach out at
Want to support this project?
You can support via
or, visit our merch store and support us by purchasing a merch for only $USD 17.00 (Including shipping worldwide & duties)
for more information, visit our
Official Website
Screenshots
