GHSA-2cf5-4w76-r9qv Arbitrary Code Execution in handlebars
Attackers can execute arbitrary JavaScript code by submitting malicious templates to the handlebars library, affecting both server-side and client-side applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-2cf5-4w76-r9qv?
GHSA-2cf5-4w76-r9qv is a code injection vulnerability in handlebars, published on 4 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of `handlebars` prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).
The following template can be used to demonstrate the vulnerability: ```{{#with "constructor"}} {{#with split as |a|}} {{pop (push "alert('Vulnerable Handlebars JS');")}} {{#with (concat (lookup join (slice 0 1)))}} {{#each (slice 2 3)}} {{#with (apply 0 a)}} {{.}} {{/with}} {{/each}} {{/with}} {{/with}} {{/with}}```
## Recommendation
Upgrade to version 3.0.8, 4.5.2 or later.
Which versions are affected by GHSA-2cf5-4w76-r9qv?
4 open source packages ship an affected version, including handlebars.
| Package | Affected | Fixed in |
|---|---|---|
handlebars npm | All versions | 3.0.8 |
handlebars npm | All versions | 3.0.8 |
handlebars npm | From 4.0.0 | 4.5.2 |
handlebars npm | From 4.0.0 | 4.5.2 |
How do I fix GHSA-2cf5-4w76-r9qv?
Upgrade handlebars to a fixed version for your release line: 3.0.8 or 4.5.2.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is GHSA-2cf5-4w76-r9qv being exploited?
There is no known exploitation of GHSA-2cf5-4w76-r9qv in the wild and no public exploit code.