Executive brief
bracket-template is a JavaScript templating library that processes user-supplied variables to render HTML templates. When GET parameters are passed directly into templates without sanitization, an attacker can inject malicious JavaScript code that executes in the victim's browser when they visit a specially crafted URL. This can lead to session hijacking, credential theft, or malware distribution to website visitors.
Technical details
bracket-template contains a reflected XSS vulnerability (CWE-79) that arises from improper input neutralization of URL parameters used as template variables. The library fails to sanitize or escape GET parameter values before they are embedded into the generated HTML output. An attacker can craft a URL containing malicious JavaScript in a GET parameter and trick users into visiting it; the JavaScript executes in the victim's browser with the same privileges as the website. The vulnerability requires user interaction (clicking a link) and affects the confidentiality and integrity of the affected user's session. As of the advisory publication, no patched versions are available; the last affected version is 1.1.5 and all earlier versions are vulnerable.
Affected products
- bracket-template bracket-template <= 1.1.5
Timeline
- 2018-06-07: disclosed: Published to NVD
- 2018-07-27: advisory: Published to GitHub Advisory Database