Server-Side Template Injection in node-ejs
Summary
CVE-2023-29827: ejs v3.1.9 is vulnerable to server-side template injection. Affects node-ejs versions < aed012481d11ee9e8ca024314262b90de7c6d91e. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-ejs is a popular package used for server-side rendering of templates in Node.js applications. It provides a simple and efficient way to generate dynamic HTML content. However, a vulnerability has been discovered in version 3.1.9 of the package, which allows for server-side template injection.
Vulnerability Detail
The vulnerability (CVE-2023-29827) in node-ejs version 3.1.9 arises from the improper handling of the closeDelimiter configuration setting. If an attacker can control the ejs file, they can exploit this vulnerability to inject malicious code into the server-side template. This can lead to various security risks, including remote code execution, data leakage, and privilege escalation. It is important to note that the vendor disputes this vulnerability, claiming that the render function is not intended to be used with untrusted input.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to a patched version is not immediately feasible, a temporary workaround can be implemented by disabling the use of untrusted input in the render function. This can be achieved by validating and sanitizing any user-supplied data before passing it to the render function. Here is an example of how to sanitize user input using the 'sanitize-html' package:
const sanitizeHtml = require('sanitize-html');
const userInput = req.body.userInput;
const sanitizedInput = sanitizeHtml(userInput);
ejs.render(template, { userInput: sanitizedInput });
Conclusion
In conclusion, node-ejs version 3.1.9 is vulnerable to server-side template injection. It is crucial to upgrade to a patched version or implement the suggested workaround to mitigate the risk of exploitation. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-ejs →
FAQ
node-ejs is a package for server-side rendering of templates in Node.js applications. It allows developers to generate dynamic HTML content by combining templates with data.
Server-side template injection is a vulnerability that occurs when untrusted user input is directly embedded in a server-side template. This can lead to the execution of arbitrary code on the server and potential security breaches.
An attacker can exploit this vulnerability by controlling the ejs file and injecting malicious code through the closeDelimiter configuration setting. This can lead to various security risks, including remote code execution and data leakage.
The vendor disputes this vulnerability, claiming that the render function is not intended to be used with untrusted input. However, it is still important to take precautions and follow best practices to mitigate the potential risks.
There have been no known instances of this vulnerability being exploited in the wild. However, it is always recommended to stay updated with the latest security patches and follow secure coding practices to minimize the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for node-ejs.
