Junglewise Threat Intelligence

CVE-2019-20920: Handlebars arbitrary code execution in lookup helper

CVE-2019-20920 · Severity: low · CVSS 3.1 · Published 2022-02-10

Technologies: Handlebars.js Handlebars.

Executive brief

Handlebars, a popular web templating engine, is vulnerable to a flaw that allows attackers to execute unauthorized code. By submitting a specially crafted template, an attacker can run arbitrary JavaScript on the server or in a user's browser. This could lead to full server takeover, data theft, or the compromise of user sessions via Cross-Site Scripting (XSS).

Technical details

Handlebars versions before 3.0.8 and 4.x before 4.5.3 are vulnerable to arbitrary code execution (CWE-94). The root cause is a failure in the 'lookup' helper to properly validate templates, specifically when checking for the 'constructor' property. An attacker can exploit this by submitting a malicious template that bypasses security restrictions to execute arbitrary JavaScript. This can occur either on the server-side (Remote Code Execution) or client-side (Cross-Site Scripting) depending on where the template is processed. The vulnerability is patched in versions 3.0.8 and 4.5.3.

Affected products

  • Handlebars.js handlebars < 3.0.8, >= 4.0.0 < 4.5.3

Timeline

  • 2019-11-14: disclosed: Vulnerability disclosed by Francois Lajeunesse-Robert
  • 2020-09-30: advisory: NVD published CVE-2019-20920
  • 2022-02-10: advisory: GitHub Advisory published

References