Executive brief
EJS is a popular JavaScript templating engine used to generate HTML markup with plain JavaScript. A vulnerability in how it processes user-provided data allows an attacker to execute arbitrary code on the server. This could lead to a complete system takeover, unauthorized access to sensitive customer data, or a total service outage.
Technical details
EJS versions prior to 2.5.3 are vulnerable to remote code execution (RCE) via the ejs.renderFile() and ejs.render() functions. The vulnerability arises because EJS allows configuration options to be passed within the same object as the template data. If an application passes user-controlled input (such as URL query parameters) directly into these functions, an attacker can overwrite internal options like 'root'. By manipulating the 'root' option, an attacker can redirect the engine to include and execute malicious files from an arbitrary directory. This is classified as an input validation error (CWE-20) and code injection (CWE-94). The issue was mitigated in version 2.5.3 by blacklisting sensitive options from being passed via the data object.
Affected products
- mde ejs < 2.5.3
Timeline
- 2016-11-27: disclosed: Issue reported to package owner by Snyk
- 2016-11-28: patched: Version 2.5.3 released to fix the vulnerability
- 2017-11-16: advisory: NVD published CVE-2017-1000228