CVE-2025-14700: Crafty Controller RCE Vulnerability

CVE-2025-14700 Overview

An input neutralization vulnerability exists in the Webhook Template component of Crafty Controller that allows a remote, authenticated attacker to perform remote code execution via Server-Side Template Injection (SSTI). This vulnerability enables attackers with valid credentials to inject malicious template directives that are processed server-side, resulting in arbitrary code execution on the underlying system.

Critical Impact

Authenticated attackers can achieve full remote code execution on servers running Crafty Controller through malicious webhook template payloads, potentially compromising Minecraft server infrastructure and connected systems.

Affected Products

• Crafty Controller 4.6.1
• craftycontrol crafty_controller

Discovery Timeline

• 2025-12-17 - CVE-2025-14700 published to NVD
• 2025-12-23 - Last updated in NVD database

Technical Details for CVE-2025-14700

Vulnerability Analysis

This vulnerability falls under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), a class of flaws where user-controlled input is embedded into template expressions without adequate sanitization. Crafty Controller, a web-based management panel for Minecraft servers, implements webhook functionality that allows administrators to configure notification templates. The Webhook Template component fails to properly neutralize user-supplied input before processing it through the server-side template engine.

When an authenticated user crafts a malicious template payload, the template engine interprets and executes embedded code directives rather than treating them as literal text. This allows attackers to break out of the intended template context and execute arbitrary Python code on the server, as Crafty Controller is built on Python-based frameworks.

Root Cause

The root cause of this vulnerability is improper input neutralization in the Webhook Template processing functionality. The application accepts user-provided template strings and passes them directly to the template rendering engine without sanitizing or escaping special template syntax characters. This allows attackers to inject template directives that are interpreted as executable code rather than static content.

Template engines typically use special delimiters (such as {{, }}, {%, %}) to distinguish code from static text. When user input containing these delimiters is processed without proper escaping, the template engine executes the injected code with the privileges of the web application process.

Attack Vector

The attack is network-based and requires low-privilege authenticated access to the Crafty Controller web interface. An attacker must have valid credentials to access the webhook configuration functionality, but no additional user interaction is required for exploitation. The vulnerability has a changed scope, meaning successful exploitation can impact resources beyond the vulnerable component itself.

The exploitation process involves accessing the webhook template configuration interface and injecting malicious template syntax into template fields. When the webhook is triggered or the template is previewed, the malicious payload is processed by the template engine, resulting in arbitrary code execution. Common SSTI payloads for Python-based template engines leverage built-in classes and methods to achieve command execution.

For detailed technical information and discussion, refer to the GitLab Issue Discussion.

Detection Methods for CVE-2025-14700

Indicators of Compromise

• Unusual template syntax patterns in webhook configuration fields, particularly containing Python class references like __class__, __mro__, __subclasses__, or __globals__
• Unexpected child processes spawned by the Crafty Controller application process
• Anomalous outbound network connections originating from the Crafty Controller server
• Unauthorized modifications to webhook configurations in the application database

Detection Strategies

• Monitor webhook template fields for injection patterns such as {{, {%, __class__, __import__, subprocess, or os.popen
• Implement application-layer logging to capture all webhook template modifications with user attribution
• Deploy endpoint detection rules to identify Python process spawning unexpected shell commands
• Audit authentication logs for unusual login patterns targeting accounts with webhook configuration privileges

Monitoring Recommendations

• Enable verbose logging for all webhook-related operations in Crafty Controller
• Configure SentinelOne agents to monitor for suspicious process chains originating from Python web application processes
• Implement file integrity monitoring on Crafty Controller configuration files and directories
• Set up alerting for any modifications to webhook templates outside of approved change windows

How to Mitigate CVE-2025-14700

Immediate Actions Required

• Review and audit all existing webhook templates for potentially malicious content
• Restrict webhook configuration privileges to only trusted administrator accounts
• Consider temporarily disabling webhook functionality until patches are applied
• Implement network segmentation to limit the blast radius of potential compromise
• Monitor Crafty Controller servers for signs of unauthorized access or code execution

Patch Information

Organizations running Crafty Controller 4.6.1 should monitor the GitLab Issue Discussion for official patch releases and upgrade guidance. Apply security updates as soon as they become available from the Crafty Controller development team.

Workarounds

• Implement strict access controls limiting which users can modify webhook templates
• Deploy a web application firewall (WAF) with rules to detect and block common SSTI payloads
• Use network-level restrictions to limit Crafty Controller access to trusted IP addresses only
• Consider running Crafty Controller in a containerized or sandboxed environment to limit the impact of code execution
• Regularly backup server configurations and maintain incident response procedures

# Example: Restrict Crafty Controller network access using iptables
# Allow only trusted admin networks to access the web interface
iptables -A INPUT -p tcp --dport 8443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP