Executive brief
Handlebars.js is a popular templating engine used to dynamically generate HTML and other content in web applications. A critical vulnerability allowed attackers to inject malicious template code that could execute arbitrary JavaScript on the server or client. This could lead to full system compromise if an attacker could control template input.
Technical details
The vulnerability is a template injection flaw in Handlebars.js versions before 4.1.0, where attackers could access the "constructor" property in compiled templates to break out of the sandbox and execute arbitrary code. The root cause was insufficient input sanitization in template compilation, allowing access to non-enumerable properties via the constructor chain. An attacker must be able to inject or control template content passed to Handlebars.compile(). The fix, released in version 4.1.0, explicitly prohibits access to constructor properties in template evaluation, blocking the gadget chain used for code execution.
Affected products
- Handlebars Handlebars.js before 4.1.0
Timeline
- 2019-07-15: disclosed
- 2019-07-15: patched: Fixed in version 4.1.0