CVE-2024-22722: Form Tools SSTI RCE Vulnerability

CVE-2024-22722 Overview

CVE-2024-22722 is a Server-Side Template Injection (SSTI) vulnerability in Form Tools 3.1.1, an open-source form management application. The flaw exists in the Group Name field of the add forms section. An authenticated attacker with high privileges can inject template directives that the server evaluates, resulting in arbitrary command execution on the host. The issue is tracked under CWE-94 (Improper Control of Generation of Code).

Critical Impact
Authenticated attackers can execute arbitrary operating system commands on the underlying Form Tools server, compromising confidentiality, integrity, and availability of the application and its stored form submissions.

Affected Products

Form Tools 3.1.1
CPE: cpe:2.3:a:formtools:form_tools:3.1.1
Deployments exposing the administrative add-forms interface

Discovery Timeline

2024-04-11 - CVE-2024-22722 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22722

Vulnerability Analysis

Form Tools uses a server-side template engine to render administrative content. The application passes user-supplied input from the Group Name field directly into template rendering without sanitization or context-aware escaping. When the template engine parses the attacker-controlled string, it evaluates embedded expressions as code rather than treating them as literal text.

Because the injection point is reachable through the standard administrative workflow for adding forms, exploitation follows a common SSTI pattern. Attackers submit payloads containing template syntax that resolves to object references exposing runtime methods. From there, the payload chains into command execution primitives available in the underlying language runtime.

Exploitation requires authenticated access with high privileges, and the attack is delivered over the network against the web interface.

Root Cause

The root cause is improper neutralization of directives in a data template ([CWE-94]). The Group Name parameter under the add forms section is concatenated into a template context that is subsequently evaluated. No allow-list, escape function, or sandboxed rendering mode is applied before evaluation.

Attack Vector

An authenticated administrator-level user navigates to the add forms functionality and supplies a malicious value in the Group Name field. The server evaluates the template expression during form processing and executes the embedded logic. Refer to the Hakai Security web vulnerabilities analysis for technical write-up details.

No verified public proof-of-concept code is available. See the referenced advisory for exploitation details.

Detection Methods for CVE-2024-22722

Indicators of Compromise

Unexpected child processes (for example sh, bash, cmd.exe, powershell.exe) spawned by the PHP interpreter or web server user hosting Form Tools.
HTTP POST requests to the add-forms endpoint containing template metacharacters such as {{, }}, ${, or <% in the group_name parameter.
New or modified files under the Form Tools web root that were not deployed by administrators.
Outbound network connections initiated by the web server process to attacker-controlled infrastructure.

Detection Strategies

Inspect web server access logs for POST requests to Form Tools administrative URLs carrying template syntax in form field values.
Alert on process lineage where the web server or PHP handler spawns shell interpreters or reconnaissance binaries such as id, whoami, or uname.
Deploy web application firewall rules that flag template metacharacter sequences in authenticated admin form submissions.

Monitoring Recommendations

Enable verbose audit logging for Form Tools administrative actions, including form and group creation events.
Correlate authentication logs with subsequent form-configuration changes to identify anomalous admin activity.
Monitor file integrity on the Form Tools installation directory to detect unauthorized modifications.

How to Mitigate CVE-2024-22722

Immediate Actions Required

Restrict access to the Form Tools administrative interface to trusted networks or VPN users only.
Rotate credentials for all administrative accounts and enforce strong, unique passwords.
Review recent form and group creation activity for suspicious template metacharacters in stored values.
Audit the underlying host for unauthorized processes, files, and outbound connections initiated by the web server user.

Patch Information

At the time of publication, no vendor advisory URL is listed in the NVD entry for CVE-2024-22722. Administrators should monitor the Form Tools project for updated releases beyond 3.1.1 and apply any available security fixes. Consult the Hakai Security analysis for additional context.

Workarounds

Limit administrative account provisioning and remove unused high-privilege accounts.
Place the Form Tools application behind a web application firewall configured to block template-injection patterns in POST parameters.
Run the PHP handler under a least-privilege operating system account with restricted filesystem and network permissions.
Disable or firewall the add-forms endpoint if it is not required for current operations.

bash

# Example: restrict admin path to internal network via nginx
location /formtools/admin/ {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://formtools_backend;
}