PT-2021-19955 · Hbs · Hbs

Agustin Gianni + 1 · Published 2021-08-16 · Updated 2022-07-02 · CVE-2021-32822

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions hbs (affected versions not specified)

Description The hbs package, an Express view engine wrapper for Handlebars, may be vulnerable to a file disclosure issue depending on its usage. This occurs because hbs combines pure template data with engine configuration options through the Express render API, allowing the overwrite of internal configuration options. This can trigger a file disclosure vulnerability in downstream applications.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Information Disclosure

Weakness Enumeration

CWE-538

CWE-94

CWE-200

Related Identifiers

CVE-2021-32822

GHSA-7F5C-RPF4-86P8

Affected Products

Hbs

References · 5

• 🔥 https://securitylab.github.com/advisories/GHSL-2021-020-pillarjs-hbs · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-32822 · Security Note
• https://osv.dev/vulnerability/GHSA-7f5c-rpf4-86p8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32822 · Vendor Advisory
• https://github.com/pillarjs/hbs · Note