@blakeembrey/template vulnerable to code injection when attacker controls template input

The primary impact of CVE-2024-45390 is the ability for an attacker to execute arbitrary code within the context of the Node.js application using the @blakeembrey/template library. This is achieved by crafting a malicious template name that contains JavaScript code. If the attacker has write access to the template file, they can inject this malicious code, which will then be executed when the template is rendered. This could allow an attacker to steal sensitive data, modify application behavior, or even gain remote control of the server. The provided example demonstrates how a simple template call can be exploited to execute arbitrary code, highlighting the severity of the vulnerability.

Applications built with Node.js that utilize the @blakeembrey/template library and allow users to provide input that influences the template name are at risk. This includes applications that dynamically generate templates based on user-supplied data, such as content management systems or web applications with customizable templates. Developers who haven't updated their dependencies are particularly vulnerable.

• nodejs / server:

  npm list @blakeembrey/template

Check the installed version of @blakeembrey/template. If it's less than 1.2.0, the system is vulnerable. • nodejs / server:

  find . -name "template.js" -print0 | xargs -0 grep -i "exploit() {}"

Search for suspicious code patterns within template files that might indicate exploitation attempts. • generic web: Review application logs for any unusual activity related to template rendering or file access. Look for errors or unexpected behavior that could indicate an attempted code injection.

1. 2024-09-03Disclosure

   disclosure

1. Gereserveerd2024-08-28
2. Gepubliceerd2024-09-03
3. Gewijzigd2024-11-18
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2024-45390 is to upgrade to version 1.2.0 or later of the @blakeembrey/template library. This version includes a fix that prevents the code injection vulnerability. If upgrading is not immediately feasible, a workaround is to avoid using untrusted input as the template display name. This prevents the attacker from injecting malicious code through the template name. Thorough input validation and sanitization should be implemented to ensure that only trusted data is used in template rendering. After upgrading, confirm the fix by attempting to render a template with a deliberately malicious name and verifying that the code is not executed.