Quick answers
- Is CVE-2022-29078 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2022-29078 being exploited in the wild.
- How severe is CVE-2022-29078?
- Low severity, with a CVSS score of 3.1, published 26 April 2022.
- Which products and versions are affected?
- ejs (npm) SEMVER:introduced=0,fixed=3.1.7.
- Is there a fix for CVE-2022-29078?
- Yes. ejs (npm): upgrade to 3.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2022-29078 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2022-29078?
- Check whether you run ejs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- ejs (npm): upgrade to 3.1.7 or later
npm install ejs@3.1.7
Technical details
The vulnerability is a server-side template injection (CWE-74) in ejs versions up to 3.1.6, where the outputFunctionName setting option is not properly sanitized. An attacker can inject an arbitrary OS command by manipulating the settings[view options][outputFunctionName] parameter, which is then executed during template compilation. The attack requires network access to a vulnerable application that accepts user-controlled template options, typically through web request parameters or configuration files. An attacker can achieve remote code execution with the privileges of the Node.js process. The fix, released in version 3.1.7, sanitizes option names to prevent injection of arbitrary code.
Affected products
- ejs ejs before 3.1.7
Identifiers
- CVE-2022-29078
- GHSA-phwq-j96m-2c2q
Timeline
- 2022-04-26: disclosed
- 2022-04-27: patched: Fix released in version 3.1.7
- 2022-04-25: other: NVD published CVE-2022-29078