Critical Server-Side Template Injection Vulnerability in node-ejs Package
Summary
UBUNTU-CVE-2022-29078: The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. Affects node-ejs versions 2.5.2-1 – 2.5.7-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-ejs package is a popular templating engine for Node.js that allows developers to generate HTML markup with embedded JavaScript. It is widely used for rendering dynamic web pages and provides features such as layout support and template inheritance. However, a critical vulnerability has been identified in certain versions of this package, which can lead to severe security risks if not addressed promptly.
Vulnerability Detail
The vulnerability, identified as CVE-2022-29078, allows for server-side template injection due to improper handling of the 'outputFunctionName' option in the ejs package. An attacker can exploit this flaw by injecting arbitrary OS commands that are executed during template compilation. This could lead to unauthorized access, data manipulation, or even complete system compromise, making it a significant threat to applications utilizing affected versions of node-ejs.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can sanitize inputs to the template engine to prevent injection attacks. However, this is not a substitute for applying the necessary updates. It is recommended to avoid using the vulnerable features until the package is updated.
Conclusion
The CVE-2022-29078 vulnerability in the node-ejs package poses a critical risk to applications using affected versions. It is essential to update to the latest patched version to safeguard against potential exploitation. Regular monitoring and using tools like Vulert can help maintain security in open-source software.
See every vulnerability recorded for node-ejs →
FAQ
CVE-2022-29078 is a critical vulnerability in the node-ejs package that allows for server-side template injection, enabling attackers to execute arbitrary OS commands.
The affected versions include node-ejs 2.5.7-1 and 3.1.6-2. It is crucial to update to the latest version to mitigate the risk.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized access, data manipulation, and complete system compromise, posing serious risks to application security.
If immediate updates are not possible, implement input sanitization as a temporary workaround and monitor for any suspicious activity in your application.
Related vulnerabilities
Recent vulnerabilities recorded for node-ejs.
