PT-2017-7493 · Handlebars+1 · Handlebars+1

Publicado

2017-01-23

·

Atualizado

2020-04-22

·

CVE-2015-8861

CVSS v3.1

6.1

Média

VetorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions handlebars versions prior to 4.0.0
Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted. This occurs when attributes in handlebar templates are not properly encapsulated, leading to potential execution of malicious scripts. For example, a template like <a href={{foo}}/> can be exploited with an input like { 'foo' : 'test.com onload=alert(1)'}, resulting in a rendered output of <a href=test.com onload=alert(1)/> that can execute the onload script.
Recommendations Update to version 4.0.0 or later. Alternatively, ensure that all attributes in handlebars templates are encapsulated with quotes.

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-8861
GHSA-9PRH-257W-9277
GHSA-FMR4-7G9Q-7HC7

Produtos afetados

Debian
Handlebars