Executive brief
constantinople is a Node.js library used for evaluating and analyzing Pug template expressions. Versions before 3.1.1 contain a sandbox bypass vulnerability that allows attackers to execute arbitrary code on the server, potentially leading to complete system compromise and data exposure.
Technical details
constantinople versions prior to 3.1.1 are vulnerable to a sandbox bypass that permits arbitrary code execution. The vulnerability exists in the expression evaluation mechanism, which was rewritten in version 3.1.1 to properly evaluate the Abstract Syntax Tree (AST) instead of using unsafe eval()-style operations. The attack vector is network-based if the library processes untrusted Pug template input. An attacker can craft malicious template expressions that escape the sandbox sandbox restrictions and execute arbitrary code in the application's context. The fix involves upgrading to constantinople 3.1.1 or later.
Affected products
- pugjs constantinople before 3.1.1
Timeline
- 2018-05-14: disclosed
- 2018: patched: version 3.1.1 released with fix
- 2020-07-31: advisory