CVE-2024-54954: Zhyd OneBlog Template Injection Flaw

CVE-2024-54954 Overview

CVE-2024-54954 is a template injection vulnerability in OneBlog v2.3.6, an open-source blogging platform maintained by zhyd. The flaw resides in the template management department of the application, allowing an authenticated attacker to inject malicious template expressions that the server evaluates during rendering. Successful exploitation can result in arbitrary code execution, data compromise, and full application takeover. The vulnerability is classified under [CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine].

Critical Impact
Authenticated attackers can inject server-side template expressions through the template management feature, leading to arbitrary code execution and full compromise of the OneBlog host.

Affected Products

Zhyd OneBlog v2.3.6
OneBlog template management component
Deployments exposing the administrative template interface to untrusted users

Discovery Timeline

2025-02-10 - CVE-2024-54954 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54954

Vulnerability Analysis

The vulnerability exists in the template management functionality of OneBlog v2.3.6. The application accepts template content from authenticated users and passes it to a server-side template engine without proper neutralization of expression syntax. When the engine renders the crafted template, embedded expressions are evaluated in the application context.

Attackers with access to the template management department can substitute legitimate template markup with expressions that invoke runtime objects, reflection APIs, or system commands. Because the injected code executes with the privileges of the OneBlog process, the impact extends beyond the web tier to the underlying host.

Exploitation requires network access to the administrative interface and valid low-privileged credentials. User interaction is required to trigger rendering of the malicious template. Public discussion of the issue and a proof-of-concept are referenced in the Gitee Issue Discussion and the GitHub Gist PoC Code.

Root Cause

The root cause is improper neutralization of special elements used in a template engine [CWE-1336]. OneBlog treats user-supplied template content as trusted input and does not sandbox or restrict expression evaluation. This allows expressions that reach out to runtime classes or execute operating system commands during template rendering.

Attack Vector

The attack vector is network-based against the OneBlog administrative surface. An attacker authenticates to the application, navigates to the template management department, and submits a crafted template containing engine-specific expression syntax. When an administrator or user renders the affected template, the payload executes on the server.

Refer to the linked proof-of-concept for the exact template syntax and request structure used to trigger execution.

Detection Methods for CVE-2024-54954

Indicators of Compromise

Unexpected modifications to template records in the OneBlog database, particularly entries containing expression delimiters such as ${...}, #{...}, or <%...%>.
Child processes spawned by the OneBlog Java process, including shells (sh, bash, cmd.exe) or scripting interpreters.
Outbound network connections from the OneBlog host to attacker-controlled infrastructure shortly after template rendering.
Access log entries showing POST requests to template management endpoints from unusual source addresses or accounts.

Detection Strategies

Inspect application logs for template create or update operations followed by rendering activity from the same session.
Deploy web application firewall rules that flag template payloads containing reflection APIs such as Runtime.getRuntime() or ProcessBuilder.
Monitor endpoint telemetry for process lineage where the Java runtime executing OneBlog spawns operating system commands.

Monitoring Recommendations

Enable audit logging for all administrative actions against template management endpoints and forward events to a centralized SIEM.
Alert on any changes to OneBlog template content outside approved change windows.
Baseline outbound network traffic from the OneBlog host and alert on deviations that follow template edits.

How to Mitigate CVE-2024-54954

Immediate Actions Required

Restrict access to the OneBlog administrative interface to trusted networks and administrators only.
Rotate credentials for any account with template management privileges and enforce strong authentication.
Audit existing templates for suspicious expression syntax and remove unauthorized entries.
Review server logs for evidence of exploitation attempts referencing the template management department.

Patch Information

As of the last NVD update on 2026-06-17, no fixed version is referenced in the advisory. Track the Gitee Issue Discussion for vendor updates and apply any release that addresses the template injection issue in versions after v2.3.6.

Workarounds

Disable or remove the template management feature if it is not required for operations.
Place the OneBlog administrative endpoints behind a reverse proxy that enforces IP allow-listing and multi-factor authentication.
Run the OneBlog process as an unprivileged user in a sandboxed container to limit the blast radius of successful exploitation.
Apply web application firewall signatures that block template expression syntax in POST bodies targeting template endpoints.

bash

# Example nginx configuration to restrict access to the template management path
location /admin/template/ {
    allow 10.0.0.0/8;
    deny all;
    auth_basic "OneBlog Admin";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://oneblog_backend;
}