CVE-2020-8644
PlaySMS Server-Side Template Injection Vulnerability
Description
CVE-2020-8644 is a critical code injection vulnerability in PlaySMS, an open-source web-based SMS gateway platform. PlaySMS before version 1.4.3 fails to properly sanitize user inputs, enabling server-side template injection (SSTI) that leads to remote code execution. An unauthenticated attacker with network access can exploit this vulnerability to execute arbitrary code on the server hosting PlaySMS. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 94.00% (99.89th percentile), this PlaySMS code injection vulnerability has a near-certain probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| playsms | playsms | < 1.4.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/157106/PlaySMS-index.php-Unauthenticated-Template-Injection-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://forum.playsms.org/t/playsms-1-4-3-has-been-released/2704(Broken Link, Release Notes, Vendor Advisory)
- https://playsms.org/2020/02/05/playsms-1-4-3-has-been-released/(Vendor Advisory)
- https://research.nccgroup.com/2020/02/11/technical-advisory-playsms-pre-authentication-remote-code-execution-cve-2020-8644/(Exploit)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8644(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
Code injection occurs when software constructs code segments using externally-influenced input without properly neutralizing special elements that could alter the intended code behavior. In the case of CVE-2020-8644, PlaySMS fails to sanitize user-supplied inputs, allowing attackers to inject and execute arbitrary server-side template code, which is a specific form of code injection known as server-side template injection (SSTI).
Mehr erfahren: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
CVE-2020-8644 carries a CVSS 3.1 base score of 9.8 (CRITICAL), representing maximum severity. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, making it trivially accessible to any attacker who can reach the PlaySMS web interface. Successful exploitation grants the attacker full remote code execution on the server, with high impact to confidentiality, integrity, and availability — all data on the system can be accessed, applications and configurations can be modified, and service availability can be completely disrupted. The EPSS score of 94.00% places this vulnerability at the 99.89th percentile, indicating near-certain active exploitation. Organizations running PlaySMS versions prior to 1.4.3 face immediate risk of complete server compromise.
Exploit Maturity
CVE-2020-8644 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. Public exploit code is available for CVE-2020-8644 via Packet Storm Security, demonstrating unauthenticated template injection leading to code execution. Additional technical details and exploit analysis are available from NCC Group Research. The EPSS score of 94.00% (99.89th percentile) indicates near-certain exploitation activity. The availability of pre-authentication exploit code significantly lowers the barrier for attackers and makes this vulnerability an immediate priority for remediation.
Remediation
- Apply vendor updates immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade PlaySMS to version 1.4.3 or later, which addresses this server-side template injection vulnerability.
- Verify that all PlaySMS deployments have been updated from vulnerable versions (all versions prior to 1.4.3) to the patched release.
- If immediate upgrading is not possible, restrict network access to the PlaySMS web interface by placing it behind a reverse proxy with IP-based access controls, ensuring only authorized users can reach the application. Disable or remove any unused functionality that processes user input.
- Monitor web server logs for indicators of template injection attempts, including unusual characters or code patterns in request parameters. Review system logs for signs of unauthorized command execution or unexpected process spawning.
- As a long-term hardening measure, implement a web application firewall (WAF) with rules to detect template injection patterns, apply the principle of least privilege to the PlaySMS application process, and consider migrating to a sandboxed server-side template engine that restricts code execution capabilities.
Technical Details
CVE-2020-8644 is a server-side template injection (SSTI) vulnerability in PlaySMS before version 1.4.3. The application fails to sanitize inputs from malicious strings, allowing attackers to inject template directives that are interpreted and executed by the server-side template engine. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that the vulnerability is exploitable remotely without authentication, privileges, or user interaction, with maximum impact across all three security dimensions. This vulnerability is classified under CWE-94 (Code Injection), as the template injection effectively allows the attacker to execute arbitrary code within the application's server-side context. The pre-authentication nature of this vulnerability is particularly dangerous, as attackers can achieve full remote code execution simply by sending crafted HTTP requests to the PlaySMS index.php endpoint.
Frequently Asked Questions
Is CVE-2020-8644 being actively exploited?
Yes. CVE-2020-8644 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.00% (99.89th percentile) further indicates near-certain exploitation activity, and multiple public exploits are available demonstrating pre-authentication remote code execution.
What products are affected by CVE-2020-8644?
CVE-2020-8644 affects PlaySMS versions prior to 1.4.3. All installations running earlier versions of PlaySMS are vulnerable to this server-side template injection attack.
How do I fix CVE-2020-8644?
Upgrade PlaySMS to version 1.4.3 or later, which addresses this vulnerability. If immediate upgrading is not possible, restrict network access to the PlaySMS web interface using firewall rules and reverse proxy configurations to limit exposure.
How severe is CVE-2020-8644?
CVE-2020-8644 has a CVSS 3.1 base score of 9.8 (CRITICAL) and an EPSS score of 94.00% at the 99.89th percentile. This is a maximum-severity vulnerability that allows unauthenticated remote code execution and requires immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.