Full Report
CERT Polska has received a report about 2 vulnerabilities (CVE-2026-34906 and CVE-2026-34907) found in Wirtualna Uczelnia software.
Analysis Summary
# Vulnerability: Multiple Flaws in Wirtualna Uczelnia (SSTI & XSS)
## CVE Details
- **CVE ID**: CVE-2026-34906 (SSTI), CVE-2026-34907 (XSS)
- **CVSS Score**: Not explicitly provided in source (Estimated: Critical for CVE-2026-34906; Medium for CVE-2026-34907)
- **CWE**:
- CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
## Affected Systems
- **Products**: Wirtualna Uczelnia (by Simple SA)
- **Versions**: All versions through `wu#2016.437.295#0#20260327_105545`
- **Configurations**: Default installations utilizing the `redirectToUrl` endpoint or those processing the `locale` parameter.
## Vulnerability Description
The software suffers from two distinct security flaws:
1. **CVE-2026-34906 (Server-Side Template Injection):** The `redirectToUrl` endpoint fails to adequately validate the `redirectUrlParameter`. This allows an attacker to inject arbitrary template expressions which the server then executes. Because the template engine has access to underlying system processes, this leads to Remote Code Execution (RCE).
2. **CVE-2026-34907 (Reflected Cross-Site Scripting):** Multiple endpoints handle the `locale` parameter insecurely. Malicious JavaScript provided in this parameter is reflected back to the user's browser without proper sanitization.
## Exploitation
- **Status**: Reported via Coordinated Vulnerability Disclosure (CVD); PoC details are described in the advisory technical summary.
- **Complexity**:
- CVE-2026-34906: Medium (Requires knowledge of the specific template engine syntax).
- CVE-2026-34907: Low.
- **Attack Vector**: Network (Remote)
## Impact
- **Confidentiality**: High (Full system access via RCE / Session hijacking via XSS)
- **Integrity**: High (Ability to modify server files or perform actions as other users)
- **Availability**: High (Ability to execute remote commands or establish reverse shells)
## Remediation
### Patches
- Users should contact the vendor (**Simple SA**) to obtain the latest security updates. Versions released after June 02, 2026, or successor versions to `wu#2016.437.295#0...` should contain the fixes.
### Workarounds
- Implement Web Application Firewall (WAF) rules to:
- Block suspicious characters (e.g., `${}`, `{{}}`, `<% %>`) in the `redirectUrlParameter`.
- Sanitize or restrict the `locale` parameter to known valid language codes.
- Restrict access to the `redirectToUrl` endpoint if it is not required for business operations.
## Detection
- **Indicators of Compromise**: Monitor web logs for the `redirectToUrl` endpoint containing template syntax or OS commands.
- **Detection Methods**: Use vulnerability scanners to test for reflected input in the `locale` parameter across all web interfaces.
## References
- CERT Polska Advisory: [https://cert.pl/en/posts/2024/06/vulnerabilities-in-wirtualna-uczelnia/](https://cert.pl/en/posts/2024/06/vulnerabilities-in-wirtualna-uczelnia/)
- CVE-2026-34906: [https://www.cve.org/CVERecord?id=CVE-2026-34906](https://www.cve.org/CVERecord?id=CVE-2026-34906)
- CVE-2026-34907: [https://www.cve.org/CVERecord?id=CVE-2026-34907](https://www.cve.org/CVERecord?id=CVE-2026-34907)