CVE-2022-29078 ejs template injection vulnerability
Attackers can execute arbitrary OS commands via server-side template injection in the EJS library, requiring immediate upgrades.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-29078?
CVE-2022-29078 is a critical code injection vulnerability in n/a, published on 25 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Weakness: CWE-94
Which versions are affected by CVE-2022-29078?
2 open source packages ship an affected version, including ejs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ejs npm | All versions | 3.1.7 |
ejs npm | All versions | 3.1.7 |
Products include Ejs Ejs.
How do I fix CVE-2022-29078?
Upgrade ejs to 3.1.7 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-29078 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-29078 exists.
Public exploit code: 1 Nuclei template and 9 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2022-29078, GHSA-phwq-j96m-2c2q, ROOT-APP-NPM-CVE-2022-29078, UBUNTU-CVE-2022-29078.