Critical Server-Side Template Injection Vulnerability in node-ejs Package
Summary
UBUNTU-CVE-2023-29827: DISPUTED ejs v3.1.9 is vulnerable to server-side template injection. Affects node-ejs versions 2.5.2-1 – 2.5.7-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-ejs package is a popular templating engine for Node.js, allowing developers to generate HTML markup with plain JavaScript. It is widely used in web applications for rendering dynamic content. However, versions of node-ejs prior to the patched version are susceptible to a critical vulnerability that can lead to server-side template injection, potentially compromising the security of applications using this package.
Vulnerability Detail
The vulnerability identified as UBUNTU-CVE-2023-29827 affects node-ejs version 3.1.9 and earlier. It allows an attacker to exploit the closeDelimiter parameter in controllable ejs files, leading to server-side template injection. This can result in unauthorized access to sensitive data or execution of arbitrary code. Although the vendor disputes the severity of this issue, the potential for exploitation remains a significant concern, especially in applications that handle untrusted input.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using untrusted input with the render function of node-ejs. Ensure that all ejs files are controlled and do not accept user-generated content that could be exploited.
Conclusion
The node-ejs package has a critical vulnerability that can lead to server-side template injection. It is essential for developers to update to the latest version to protect their applications. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for node-ejs →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
All versions of node-ejs prior to the patched version 3.1.9 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, implement strict input validation and avoid using untrusted data in your ejs templates as a temporary measure.
Yes, a patched version of node-ejs is available. It is crucial to update to this version to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-ejs.
