CVE-2025-14700: Crafty Controller RCE Vulnerability

CVE-2025-14700 Overview

CVE-2025-14700 is a Server-Side Template Injection (SSTI) vulnerability in the Webhook Template component of Crafty Controller, a web-based Minecraft server management platform. The flaw stems from improper neutralization of input passed to the template engine, classified under [CWE-1336] (Improper Neutralization of Special Elements Used in a Template Engine). An authenticated remote attacker can inject template syntax that the server evaluates, leading to arbitrary code execution on the host. Crafty Controller version 4.6.1 is identified in the affected CPE record.

Critical Impact
Authenticated attackers can achieve remote code execution on the Crafty Controller host through crafted webhook template payloads, with a scope change that can affect the underlying system beyond the application boundary.

Affected Products

Crafty Controller 4.6.1
Crafty Controller deployments exposing the Webhook Template feature to authenticated users
Self-hosted Minecraft server management installations running vulnerable Crafty Controller releases

Discovery Timeline

2025-12-17 - CVE-2025-14700 published to the National Vulnerability Database
2025-12-23 - Last updated in the NVD database

Technical Details for CVE-2025-14700

Vulnerability Analysis

The vulnerability resides in the Webhook Template component of Crafty Controller. Webhook templates allow users to define notification message bodies that are rendered by a server-side template engine before being dispatched. When user-supplied template content is not properly sanitized, the engine evaluates attacker-controlled directives instead of treating them as literal strings.

Server-Side Template Injection enables an attacker to break out of the templating context and reach the underlying language runtime. In Python-based template engines such as Jinja2, this typically grants access to object introspection methods, which in turn expose subprocess and OS modules. The result is arbitrary command execution under the privileges of the Crafty Controller service account.

The vulnerability requires authentication, but only low privileges are needed. The scope change in the impact metrics indicates that successful exploitation can affect resources beyond the vulnerable application itself, consistent with breaking out of the application sandbox into the host operating system. See the GitLab Issue Discussion for additional context.

Root Cause

User-controlled webhook template strings are passed to a server-side template renderer without restricting available syntax or sandboxing the execution context. The application treats trusted-by-default template input as safe even though it originates from authenticated user submissions.

Attack Vector

An attacker authenticates to Crafty Controller with any account permitted to configure webhooks. The attacker submits a webhook template containing template expressions that reference object hierarchies leading to OS-level execution primitives. When the template is rendered, either on save or on webhook trigger, the embedded payload executes on the server.

Real-world exploitation does not require code from this article. The vulnerability is described in prose per available reporting, and no verified public proof-of-concept was identified at the time of writing.

Detection Methods for CVE-2025-14700

Indicators of Compromise

Webhook template configurations containing template metacharacters such as {{, }}, {%, or references to __class__, __mro__, __subclasses__, os.popen, or subprocess.
Unexpected child processes spawned by the Crafty Controller service, particularly shells (sh, bash, cmd.exe, powershell.exe).
Outbound network connections from the Crafty Controller host that do not correlate with legitimate webhook destinations.

Detection Strategies

Inspect the Crafty Controller webhook configuration store for templates containing template engine syntax or Python dunder attribute access patterns.
Monitor process creation telemetry on the host running Crafty Controller for shells or interpreters launched as children of the Crafty Controller Python process.
Review application logs for webhook save and trigger events tied to recently modified templates and correlate with unusual host activity.

Monitoring Recommendations

Enable behavioral process monitoring on the host operating system to flag interpreter-spawned shells and reverse shell patterns.
Log and centrally store all webhook create, update, and trigger events with the submitting user identity for forensic review.
Alert on file writes to web-accessible directories or persistence locations originating from the Crafty Controller process tree.

How to Mitigate CVE-2025-14700

Immediate Actions Required

Upgrade Crafty Controller beyond version 4.6.1 once a fixed release is published by the maintainers. Track the GitLab Issue Discussion for patch availability.
Restrict access to the Crafty Controller web interface to trusted administrators only, using network controls or a VPN.
Audit existing webhook templates and remove any containing template engine syntax that was not authored by a trusted administrator.
Rotate any credentials, API tokens, or secrets accessible to the Crafty Controller service account, assuming potential compromise on exposed instances.

Patch Information

At the time of NVD publication on 2025-12-17, no vendor advisory URL is listed in the CVE record. Refer to the upstream GitLab Issue Discussion for fix status and apply the next release that addresses webhook template sanitization. Verify the installed version after upgrading and confirm that webhook rendering no longer evaluates arbitrary template expressions.

Workarounds

Disable the webhook feature entirely until a patched release is available, if webhooks are not operationally required.
Limit webhook configuration privileges to a single trusted administrator account and revoke this permission from all other roles.
Place Crafty Controller behind an authenticating reverse proxy and restrict source IP ranges to administrative networks.
Run the Crafty Controller service as an unprivileged user inside a container or sandbox to limit the blast radius of any successful template injection.

bash

# Example: restrict Crafty Controller exposure with host firewall rules
sudo ufw default deny incoming
sudo ufw allow from 10.0.0.0/24 to any port 8443 proto tcp
sudo ufw enable