Executive brief
express-hbs is a Handlebars template engine for Express.js used by web applications to render dynamic HTML pages. An insecure template configuration option allows attackers to read arbitrary files from the server's filesystem if user input is passed directly to the template renderer, potentially exposing sensitive configuration files, private keys, or source code.
Technical details
The vulnerability exists in how express-hbs mixes template data with engine configuration options through the Express render API. Specifically, the layout parameter can be manipulated to trigger file disclosure if user-supplied input (e.g., from req.query) is passed directly to res.render(). The attack is partially restricted since files lacking an extension will have .hbs automatically appended; however, files with existing extensions can be fully controlled by an attacker. The root cause is that Express.js was never intended for template options to be passed via res.render, but express-hbs does not prevent this misuse. No code-level patch has been identified; instead, documentation warnings were added to advise users to avoid passing unsanitized user input to res.render(). Affected versions through 2.4.0 lack built-in protection.
Affected products
- TryGhost express-hbs through 2.4.0
Timeline
- 2021-05-17: disclosed
- 2021-05-14: advisory: NVD published