Executive brief
Handlebars is a popular templating engine used to dynamically generate web pages and emails. A vulnerability in the lookup helper allowed attackers to inject malicious code into templates, enabling arbitrary code execution on servers processing templates or in user browsers. This could lead to data theft, account compromise, or service compromise depending on deployment context.
Technical details
The vulnerability is an arbitrary code execution flaw in Handlebars' lookup helper, which failed to properly validate user-supplied templates. An incomplete fix for a prior issue left the helper susceptible to template injection attacks. An attacker could submit a crafted template that executes arbitrary JavaScript code. The attack vector depends on deployment: server-side processing enables code execution with server privileges; client-side rendering constitutes a cross-site scripting (XSS) vector. No authentication is required if the application accepts untrusted template input. Patches are available in versions 3.0.8, 4.5.3, and later.
Affected products
- Handlebars Handlebars prior to 3.0.8 or 4.0.0 prior to 4.5.3
Timeline
- 2020-09-04: disclosed