Frappe ERPNext SSTI Vulnerability

Frappe ERPNext is a popular open-source enterprise resource planning (ERP) software used by many organizations. This vulnerability allows an attacker to inject arbitrary code into the system's Jinja2 templates, potentially leading to server-side code execution and database information leaks.

You're affected if you use Frappe ERPNext version 15.89.0 or earlier. Check with: frappe db dump (to verify the database schema) or grep "Frappe" frappe.py (to check for hardcoded values).

Note: This vulnerability is specific to Frappe ERPNext and not related to similar products like Zoho Inventory or Odoo.

1. Upgrade to Frappe ERPNext version 16.0.0 or later: https://frappe.io/docs/erpnext/upgrade
2. Immediate mitigations:
3. Restrict network access to your Frappe ERPNext instance (firewall it from the public internet)
4. Audit admin account activity for suspicious access patterns
5. Monitor for unauthorized token creation

• iamanc.github.io
• www.notion.so