A critical remote code execution vulnerability in the xiandafu beetl template engine allows unauthenticated attackers to gain full system control.

This vulnerability involves an insecure implementation of the type.new function and property reflection mechanism, which permits an unauthenticated remote attacker to execute arbitrary code on the underlying host.

The ability for an unauthenticated remote attacker to execute arbitrary code represents a total compromise of the affected system. This risk is classified as critical with a CVSS score of 9.8, as it facilitates unauthorized data access, potential lateral movement within the network, and complete service disruption.

Immediate Action: Since no specific patch version is currently identified, verify if your environment is utilizing beetl version 3.20.2 and consider isolating affected systems or restricting access to the application until a vendor-supplied update is released.

Proactive Monitoring: Monitor server logs for suspicious HTTP requests involving template processing or unexpected calls to reflection-based functions, as well as any unusual outbound network traffic originating from the application server.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests containing patterns associated with the beetl type.new function or suspicious property reflection payloads.

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in the provided data.

Given the critical severity of this vulnerability and the existence of a proof-of-concept, administrators should prioritize the identification of all instances of beetl 3.20.2 within their infrastructure. Until an official patch is available, apply restrictive network controls and monitor for signs of exploitation to mitigate the risk of full system compromise.