CVE-2021-32819 Remote code execution in squirrelly
Attackers can achieve remote code execution in applications using Squirrelly by overwriting internal configuration options via the Express render API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-32819?
CVE-2021-32819 is a high-severity code injection vulnerability in squirrellyjs squirrelly, published on 14 May 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. This issue is fixed in version 9.0.0. For complete details refer to the referenced GHSL-2021-023.
Weakness: CWE-200
Which versions are affected by CVE-2021-32819?
2 open source packages ship an affected version, including squirrelly. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
squirrelly npm | All versions | 9.0.0 |
squirrelly npm | All versions | 9.0.0 |
Products include Squirrelly Squirrelly.
How do I fix CVE-2021-32819?
Upgrade squirrelly to 9.0.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-32819 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-32819 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in squirrellyjs squirrelly
Sources
Also known as GHSA-q8j6-pwqx-pm96.