Is CVE-2015-8861 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2015-8861 being exploited in the wild.

How severe is CVE-2015-8861?

Medium severity, with a CVSS score of 6.1, published 23 January 2017.

Which products and versions are affected?

Handlebars project Handlebars < 4.0.0; handlebars (npm) SEMVER:introduced=0,fixed=4.0.0.

Is there a fix for CVE-2015-8861?

Yes. handlebars (npm): upgrade to 4.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2015-8861 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2015-8861?

Check whether you run Handlebars project Handlebars, Handlebars.Js Project Handlebars.Js or handlebars (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2015-8861: Handlebars.js XSS in unquoted template attributes

Q: Is there a fix for CVE-2015-8861?

Yes. handlebars (npm): upgrade to 4.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2015-8861 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2015-8861?

Check whether you run Handlebars project Handlebars, Handlebars.Js Project Handlebars.Js or handlebars (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2015-8861 · Severity: medium · CVSS 6.1 · Published 2017-01-23

Handlebars, a popular template engine for Node.js, is vulnerable to cross-site scripting (XSS). This occurs when templates use HTML attributes that are not enclosed in quotes, allowing an attacker to inject malicious scripts. If exploited, this could allow an attacker to steal user session data or perform unauthorized actions on behalf of users viewing the affected web pages.

Technologies: Handlebars project Handlebars, Handlebars.Js Project Handlebars.Js, handlebars (npm). Vendors: Handlebars project, Handlebars.Js Project, npm.

Quick answers

Is CVE-2015-8861 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2015-8861 being exploited in the wild.
How severe is CVE-2015-8861?: Medium severity, with a CVSS score of 6.1, published 23 January 2017.
Which products and versions are affected?: Handlebars project Handlebars < 4.0.0; handlebars (npm) SEMVER:introduced=0,fixed=4.0.0.
Is there a fix for CVE-2015-8861?: Yes. handlebars (npm): upgrade to 4.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2015-8861 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2015-8861?: Check whether you run Handlebars project Handlebars, Handlebars.Js Project Handlebars.Js or handlebars (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

handlebars (npm): upgrade to 4.0.0 or later
```
npm install handlebars@4.0.0
```

Technical details

A cross-site scripting (XSS) vulnerability exists in Handlebars.js before version 4.0.0 due to improper escaping of unquoted attributes in templates. The root cause is located in 'lib/handlebars/utils.js', where the library fails to sufficiently neutralize input when a template attribute is not wrapped in quotes. A remote attacker can exploit this by providing malicious input that is rendered into an unquoted attribute, leading to the execution of arbitrary JavaScript in the context of the victim's browser. This is a network-based attack that typically requires user interaction (viewing the rendered page). The issue is resolved in Handlebars version 4.0.0.

Affected products

Handlebars project handlebars.js < 4.0.0

Identifiers

CVE-2015-8861
GHSA-9prh-257w-9277

Timeline

2015-08-12: patched: Handlebars 4.0.0 released addressing the issue
2016-04-20: disclosed: Public disclosure via oss-security mailing list
2017-01-23: advisory: NVD published CVE-2015-8861

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.