Executive brief
Pug is a popular template engine for Node.js used to generate dynamic web pages. A vulnerability in the compiler allows remote code execution if an attacker can control the "pretty" formatting option, such as by injecting malicious values through user-supplied query parameters or form data. This could give attackers complete control over the web server.
Technical details
The vulnerability exists in Pug's handling of the "pretty" option during template compilation. If untrusted user input (e.g., query parameters) is spread into the compiler options object, an attacker can inject code that gets executed during template compilation. The root cause is insufficient sanitization of the pretty parameter before using it to generate compiled code. Attack precondition: the application must pass user-controlled data directly into template compiler options without validation. An attacker with network access can trigger remote code execution on the Node.js backend, achieving full server compromise. Patches are available in Pug 3.0.1, pug-code-gen 3.0.2, and pug-code-gen 2.0.3.
Affected products
- Pug pug <3.0.1
- Pug pug-code-gen <2.0.3 and <3.0.2
Timeline
- 2021-02-28: disclosed
- 2021-03-03: patched: Pug 3.0.1, pug-code-gen 2.0.3 and 3.0.2 released