Tianji Server-Side Template Injection Leads to RCE

Tianji, an open source analytics, uptime monitoring and server status platform, has a server-side template injection vulnerability before version 1.31.29. The formatString() function in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template() while the default evaluate pattern remains enabled.

A workspace administrator can store an evaluate block using the <% code %> form. The public survey.submit endpoint then renders a survey template when an unauthenticated user submits a response, causing the compiled template to execute server-side JavaScript in the Tianji Node.js process.

This can lead to:

• command execution
• secret disclosure
• data modification
• service disruption

The issue is fixed in version 1.31.29.