Executive brief
Handlebars is a widely-used templating engine for generating dynamic web content. This vulnerability allows attackers to execute arbitrary code on the server when applications compile untrusted templates with certain compiler options enabled. An attacker could exploit this to take complete control of affected applications, access sensitive data, or deploy malware.
Technical details
The vulnerability is a code injection flaw (CWE-94) in Handlebars' template compilation process. When specific compiling options are used to process templates from untrusted sources, the parser fails to properly sanitize prototype property access, allowing attackers to inject and execute arbitrary JavaScript code. The attack requires no authentication and no user interaction—an attacker can send a malicious template directly to a vulnerable compilation endpoint. This was fixed in version 4.7.7 by adding strict-mode prototype property access checks in the runtime.
Affected products
- Handlebars Handlebars.js before 4.7.7
Timeline
- 2021-04-12: disclosed
- 2021-04-13: patched: Patch committed to fix prototype property access checks