PT-2020-19765 · Osm Static Maps · Osm-Static-Maps

Vasilii Ermilov · Published 2020-10-20 · Updated 2021-07-21 · CVE-2020-7749

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions osm-static-maps versions prior to 3.9.0

Description The issue arises from user input being passed directly to a template without proper escaping, using {{{ ... }}}. This allows an attacker to inject arbitrary HTML or JavaScript code. Depending on the context, this can lead to Cross-Site Scripting (XSS) if the code is outputted as HTML on the page, or to Server-Side Request Forgery (SSRF) and Local File Read if the code is rendered on the server using puppeteer.

Recommendations For versions prior to 3.9.0, update to version 3.9.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of user input in templates until a patch is available. Restrict access to the puppeteer server to minimize the risk of SSRF and Local File Read exploitation. Avoid using the {{{ ... }}} syntax in templates until the issue is resolved.

Exploit

Fix

Special Elements Injection

XSS

Weakness Enumeration

CWE-74

CWE-79

Related Identifiers

CVE-2020-7749

GHSA-PXCF-V868-M492

SNYK-JS-OSMSTATICMAPS-609637

Affected Products

Osm-Static-Maps

References · 7

• 🔥 https://snyk.io/vuln/SNYK-JS-OSMSTATICMAPS-609637 · Exploit
• https://github.com/jperelli/osm-static-maps/pull/24 · Patch
• https://osv.dev/vulnerability/GHSA-pxcf-v868-m492 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7749 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7749 · Security Note
• https://github.com/jperelli/osm-static-maps/blob/master/src/template.html%23L142 · Note
• https://github.com/jperelli/osm-static-maps/commit/97355d29e08753d1cfe99b1281dbaa06f4e651b0 · Note