Executive brief
Nunjucks is a popular templating engine used by web developers to generate dynamic HTML content. A flaw in its autoescape security feature allows attackers to inject malicious JavaScript code into web pages by manipulating URL parameters, potentially stealing user credentials or session data. The vulnerability only affects versions before 3.2.4 and requires user interaction (clicking a malicious link).
Technical details
This is a cross-site scripting (XSS) vulnerability (CWE-79) caused by an incomplete autoescape bypass in the Nunjucks template engine. When two or more user-controlled variables are placed on the same line in a template, an attacker can use backslash characters in URL parameters to escape the autoescape filtering and inject arbitrary JavaScript. For example, by crafting a URL parameter like `lang=jp\&place=};alert(document.domain)//`, an attacker can inject code that executes in the victim's browser. The attack requires the victim to click on a malicious link but does not require authentication. The vulnerability was patched in Nunjucks 3.2.4 (released 2023-04-20).
Affected products
- Mozilla Nunjucks prior to 3.2.4
Timeline
- 2023-04-20: disclosed
- 2023-04-20: patched: Version 3.2.4 released