Executive brief
The doT library, a fast template engine for Node.js, contains a security flaw that allows for unauthorized code execution. If an attacker can influence the templates used by an application or manipulate global object properties, they can run malicious commands on the server. This could lead to a full system takeover, data theft, or service disruption.
Technical details
The doT package (v1.1.2 and earlier) utilizes the JavaScript Function() constructor to compile templates, which is a form of 'eval-like' behavior. This creates a code injection vulnerability (CWE-94) if an attacker can provide a malicious template string. Additionally, the library is susceptible to prototype pollution; if an attacker can modify Object.prototype, they can inject malicious code that is executed during the template compilation process. The attack requires the ability to reach the template engine with user-controlled input, typically over a network. Successful exploitation allows for arbitrary remote code execution (RCE) with the privileges of the Node.js process. The issue is fixed in version 1.1.3.
Affected products
- doT dot <= 1.1.2
Timeline
- 2020-03-15: disclosed: NVD publication date
- 2022-05-24: advisory: GitHub Advisory published