Executive brief
ejs is a popular Node.js templating engine used to generate dynamic web pages and emails. A vulnerability in versions before 3.1.7 allows attackers to inject arbitrary code through the outputFunctionName option, leading to remote code execution on the server when templates are compiled. This can result in complete compromise of the affected application and underlying system.
Technical details
The vulnerability is a server-side template injection (CWE-74) in ejs versions up to 3.1.6, where the outputFunctionName setting option is not properly sanitized. An attacker can inject an arbitrary OS command by manipulating the settings[view options][outputFunctionName] parameter, which is then executed during template compilation. The attack requires network access to a vulnerable application that accepts user-controlled template options, typically through web request parameters or configuration files. An attacker can achieve remote code execution with the privileges of the Node.js process. The fix, released in version 3.1.7, sanitizes option names to prevent injection of arbitrary code.
Affected products
- ejs ejs before 3.1.7
Timeline
- 2022-04-26: disclosed
- 2022-04-27: patched: Fix released in version 3.1.7
- 2022-04-25: other: NVD published CVE-2022-29078