Executive brief
Squirrelly is a JavaScript template engine used with web frameworks like Express to render dynamic pages. An insecure design allows attackers to inject malicious configuration options through template data, leading to remote code execution. This affects web applications that use Squirrelly to render user-supplied or untrusted template data, potentially allowing attackers to take full control of the application server.
Technical details
The vulnerability stems from Squirrelly mixing pure template data with engine configuration options via the Express render API, violating the separation between data and control. An attacker can overwrite internal configuration options by injecting specially crafted data, which is then processed as engine configuration during template rendering. The attack requires user interaction (submission of template data) but no authentication. Versions prior to 9.0.0 are affected; the fix separates data handling from configuration option processing. The vulnerability is exposed through any code path where user-controlled data is passed to Squirrelly's render function without sanitization.
Affected products
- Squirrelly Squirrelly <9.0.0
Timeline
- 2021-05-17: disclosed: GHSA-q8j6-pwqx-pm96 published
- 2021-05-14: other: CVE-2021-32819 published to NVD
- 2021-05-13: patched: Fix merged in pull request #254; version 9.0.0 released with fix