PT-2018-4725 · Mozilla · Nunjucks

Matt · Publicado 2018-05-31 · Atualizado 2019-10-09 · CVE-2016-10547

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nunjucks versions 2.4.2 and lower

Description The issue concerns a cross-site scripting vulnerability in autoescape mode. Normally, all template variables should be automatically escaped in this mode. However, by using an array for the keys, such as name[]=<script>alert(1)</script>, it is possible to bypass autoescaping and inject content into the DOM. This allows for the injection of malicious scripts, potentially leading to unauthorized actions on the affected system.

Recommendations Update to version 2.4.3 or later. As a temporary workaround, consider restricting the use of array keys in template variables to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-10547

GHSA-F7PH-P5RV-PHW2

Produtos afetados

Nunjucks

Referências · 8

• 🔥 https://github.com/mozilla/nunjucks/issues/835 · Exploit
• 🔥 https://github.com/matt-/nunjucks_test · Exploit
• 🔥 https://nodesecurity.io/advisories/147 · Exploit
• https://osv.dev/vulnerability/CVE-2016-10547 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-10547 · Nota de Segurança
• https://github.com/advisories/GHSA-f7ph-p5rv-phw2 · Nota
• https://npmjs.com/advisories/147 · Nota
• https://osv.dev/vulnerability/GHSA-f7ph-p5rv-phw2 · Aviso do Fabricante