Junglewise Threat Intelligence

CVE-2022-25948: LiquidJS prototype property information exposure

CVE-2022-25948 · Severity: low · CVSS 3.1 · Published 2022-12-22

Technologies: Harttle Liquidjs. Vendors: npm.

Executive brief

LiquidJS is a popular template engine used to process Liquid templates in JavaScript applications. When misconfigured with ownPropertyOnly set to false, the engine exposes JavaScript prototype properties—including internal functions and built-in object methods—to template code. An attacker who can control template input could exploit this to access sensitive prototype information, potentially leading to information disclosure or further exploitation.

Technical details

The vulnerability is an information exposure flaw (CWE-200) affecting LiquidJS versions before 10.0.0. When the ownPropertyOnly parameter is set to false (the default prior to v10.0.0), template evaluation does not properly restrict access to prototype chain properties. An attacker providing malicious Liquid templates can access prototype getter functions and other inherited properties (such as .length or other Object prototype methods). This requires no authentication and can be triggered by any user input passed to the template engine. The fix was introduced in version 10.0.0 by changing the default value of ownPropertyOnly to true, and a partial workaround was available starting in version 9.34.0 via the ownPropertyOnly option.

Affected products

  • harttle liquidjs before 10.0.0

Timeline

  • 2022-12-22: disclosed: Advisory published
  • 2022-12-22: patched: Fix included in version 10.0.0; workaround available in 9.34.0+

References

Related threats