CVE-2021-32817: Insecure template handling in express-hbs
Summary
CVE-2021-32817: Insecure template handling in express-hbs. Affects express-hbs versions < 2.4.0. No fix is published. How to fix ↓
Also tracked for
- handlebars · Bitnami
The same CVE-2021-32817 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
express-hbs is an Express handlebars template engine that allows mixing pure template data with engine configuration options through the Express render API. It is commonly used in Node.js applications to render dynamic HTML pages. However, a vulnerability has been discovered in express-hbs that can lead to file disclosure in downstream applications. This vulnerability is triggered by the layout parameter and can potentially expose sensitive information. It is important for users of express-hbs to be aware of this issue and take appropriate measures to mitigate the risk.
Vulnerability Detail
The vulnerability in express-hbs arises from insecure template handling. When the layout parameter is used, it can include files with existing extensions, potentially leading to file disclosure vulnerabilities. Files without extensions will have the .hbs extension appended to them. This vulnerability can be exploited by an attacker to access sensitive files on the server, potentially exposing confidential information. It is rated as moderate severity with a CVSS score of 5.4.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating express-hbs is not immediately feasible, a temporary workaround can be implemented by avoiding the use of the layout parameter or by carefully validating and sanitizing user input before using it in the layout parameter. This can help mitigate the risk of file disclosure vulnerabilities. Here is an example of how to validate and sanitize user input in the layout parameter:
const layout = req.body.layout;
// Validate and sanitize the layout parameter
if (typeof layout === 'string' && layout.endsWith('.hbs')) {
// Use the layout parameter
res.render('template', { layout });
} else {
// Handle invalid layout parameter
res.status(400).send('Invalid layout parameter');
}
Conclusion
In summary, express-hbs is vulnerable to an insecure template handling issue that can lead to file disclosure in downstream applications. It is important to update to a version beyond 2.4.0 or apply the recommended workarounds to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for express-hbs →
FAQ
express-hbs is an Express handlebars template engine used in Node.js applications to render dynamic HTML pages.
This vulnerability can lead to file disclosure in downstream applications, potentially exposing sensitive information.
To fix this vulnerability, update express-hbs to a version beyond 2.4.0 that includes the necessary security patches.
If updating express-hbs is not immediately feasible, you can implement a temporary workaround by avoiding the use of the layout parameter or by validating and sanitizing user input before using it.
You can find more information about this vulnerability in the referenced GHSL-2021-019 report and the documentation of express-hbs.
