Executive brief
EJS is a popular template engine for Node.js used to generate HTML and dynamic content. A cross-site scripting (XSS) vulnerability in the renderFile() function allows attackers to inject malicious code that could be executed in users' browsers, potentially leading to session hijacking, credential theft, or malware distribution.
Technical details
The vulnerability is a cross-site scripting (CWE-79) flaw in the ejs.renderFile() function affecting versions prior to 2.5.5. The root cause is improper input validation/sanitization of template data, allowing unsafe options to be passed through the data object without adequate blacklisting. An attacker can inject malicious JavaScript by crafting specially-formatted template data; exploitation requires user interaction (rendering a template with attacker-controlled data). The fix (commit 49264e0) blacklists additional unsafe options from passing through the data object. Patches are available in version 2.5.5 and later.
Affected products
- mde ejs before 2.5.5
Timeline
- 2017-11-30: disclosed
- 2017: patched: Fixed in version 2.5.5