PT-2018-4725 · Mozilla · Nunjucks

Matt · Published 2018-05-31 · Updated 2019-10-09 · CVE-2016-10547

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nunjucks versions 2.4.2 and lower

Description The issue concerns a cross-site scripting vulnerability in autoescape mode. Normally, all template variables should be automatically escaped in this mode. However, by using an array for the keys, such as name[]=<script>alert(1)</script>, it is possible to bypass autoescaping and inject content into the DOM. This allows for the injection of malicious scripts, potentially leading to unauthorized actions on the affected system.

Recommendations Update to version 2.4.3 or later. As a temporary workaround, consider restricting the use of array keys in template variables to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-10547

GHSA-F7PH-P5RV-PHW2

Affected Products

Nunjucks

References · 8

• 🔥 https://github.com/mozilla/nunjucks/issues/835 · Exploit
• 🔥 https://github.com/matt-/nunjucks_test · Exploit
• 🔥 https://nodesecurity.io/advisories/147 · Exploit
• https://osv.dev/vulnerability/CVE-2016-10547 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10547 · Security Note
• https://osv.dev/vulnerability/GHSA-f7ph-p5rv-phw2 · Vendor Advisory
• https://github.com/advisories/GHSA-f7ph-p5rv-phw2 · Note
• https://npmjs.com/advisories/147 · Note