Executive brief
Express-handlebars is a template rendering library used in Node.js web applications to generate dynamic HTML pages. The library fails to safely separate user-provided template data from internal configuration options, allowing attackers to read arbitrary files from the server through specially crafted requests. This could expose sensitive information like configuration files, source code, or private keys stored on the system.
Technical details
The vulnerability exists in how Express-handlebars processes the Express render API, specifically the `layout` parameter, which mixes template data with engine configuration options. An attacker can exploit this by manipulating the layout parameter to reference files with existing extensions, triggering a file disclosure vulnerability. Files without extensions will have `.handlebars` appended, limiting the scope somewhat. The attack is network-reachable and requires no authentication or user interaction. The fix involves using a `context` property to separate untrusted user data from engine options, implemented in version 5.3.1 and later.
Affected products
- Express-handlebars express-handlebars before 5.3.1
Timeline
- 2021-05-14: disclosed: Published on NVD
- 2022-02-10: advisory: Published on GitHub Advisory Database (GHSA-fr76-2wp8-fp92)
- 2021-05-17: patched: Fix merged in pull request #163; version 5.3.1 fixed