CVE-2022-45132: 
Linux Debian vulnerability analysis and mitigation

In Linaro Automated Validation Architecture (LAVA) before version 2022.11.1, a critical remote code execution vulnerability was discovered in the REST API endpoint for validating device configuration files. The vulnerability (CVE-2022-45132) allows attackers to achieve remote code execution through user-submitted Jinja2 templates in the LAVA server (MITRE CVE, Debian Tracker).

The vulnerability exists in the way LAVA server processes Jinja2 templates through its REST API endpoint for device configuration file validation. The server loads user input as a Jinja2 template without proper sandboxing or validation, allowing arbitrary code execution. This vulnerability was discovered and reported by Igor Ponomarev from Collabora (LAVA Announce).

The vulnerability allows unauthenticated remote attackers to execute arbitrary code on the LAVA server with the same privileges as the web application process. This poses a significant security risk as it could lead to complete system compromise through the web application (LAVA Announce).

The vulnerability has been fixed in LAVA version 2022.11.1. System administrators are strongly recommended to upgrade to this version immediately. If immediate upgrade is not possible, administrators should apply the specific patch (commit ab17e8304f10c7c0fe912067f2ed) to their LAVA server installation (LAVA Announce).