Executive brief
MJML is a framework for building responsive emails using a markup language. Versions before 4.6.3 suffer from a path traversal flaw in the mj-include component that allows attackers to read sensitive files from the server, leak configuration details, and crash the application. An attacker can exploit this remotely without authentication by crafting malicious MJML documents with directory traversal sequences in the include path.
Technical details
This is a path traversal vulnerability (CWE-22) in MJML's mj-include component, which fails to properly validate the "path" attribute used to include external MJML files. The vulnerability allows an attacker to use relative path sequences (e.g., "../") to escape the intended directory and access arbitrary files on the system. Attack vectors include: (1) leaking local server paths via error messages from non-existent file references, (2) enumerating files through error-based detection, (3) partial disclosure of binary files through error message contents, and (4) denial of service by reading from special files like /dev/urandom. The flaw is reachable over the network without authentication. MJML v4.6.3 addressed this by adding an "ignoreIncludes" option to disable the mj-include component by default, though it can still be explicitly enabled. Attackers targeting this must be able to provide MJML input to the application.
Affected products
- mjmlio mjml < 4.6.3
Timeline
- 2020-04-28: disclosed: Vulnerability discovered
- 2020-04-30: other: Reported to MJML maintainers
- 2020-05-05: patched: Fix released disabling includes by default
- 2020-05-13: other: CVE-2020-12827 assigned
- 2020-06-14: disclosed: Public disclosure via Full Disclosure mailing list