Executive brief
The hbs library, an Express template engine wrapper for Handlebars, contains a file disclosure vulnerability that allows attackers to read sensitive files from the server. By injecting malicious template data through the Express render API, an attacker can bypass intended access controls and expose confidential information, potentially compromising application secrets or user data.
Technical details
The vulnerability is a file disclosure issue (CWE-200, CWE-538, CWE-94) caused by hbs mixing user-controlled template data with internal engine configuration options through the Express render API. An attacker can overwrite internal configuration settings to trigger file disclosure, as detailed in GHSL-2021-020. The attack vector is network-based with high complexity (AC:H), requiring no authentication or user interaction. There is currently no patch available for this vulnerability; all versions up to and including 4.1.2 are affected.
Affected products
- pillarjs hbs up to 4.1.2
Timeline
- 2021-08-16: disclosed
- 2021-09-02: advisory