PT-2021-23145 · Unknown · Neoan3-Apps/Template

Roehrl · Published 2021-11-08 · Updated 2021-11-17 · CVE-2021-41170

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions neoan3-apps/template versions prior to 1.1.1

Description The issue arises from allowing closures to be passed directly into the template engine, which can execute values that are callable. This can lead to unintended or malicious execution if a value has the same name as a method or function in scope. All users of the package are potentially affected, especially those dealing with direct user input or database values, making a multi-step attack plausible.

Recommendations For versions prior to 1.1.1, the only safe approach is to work with hardcoded values, although this may defeat the purpose of using a template engine. Therefore, it is recommended to upgrade to version 1.1.1 or later to address this vulnerability. As a temporary workaround, consider avoiding the use of closures in the template engine until the issue is resolved.

Fix

Special Elements Injection

Incorrect Permission

Weakness Enumeration

CWE-277

CWE-74

CWE-732

Related Identifiers

CVE-2021-41170

GHSA-3V56-Q6R6-4GCW

Affected Products

Neoan3-Apps/Template

References · 8

• https://github.com/sroehrl/neoan3-template/issues/8 · Patch
• https://github.com/sroehrl/neoan3-template/commit/4a2c9570f071d3c8f4ac790007599cba20e16934 · Patch
• https://github.com/sroehrl/neoan3-template/security/advisories/GHSA-3v56-q6r6-4gcw · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41170 · Security Note
• https://osv.dev/vulnerability/GHSA-3v56-q6r6-4gcw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41170 · Vendor Advisory
• https://github.com/sroehrl/neoan3-template · Note
• https://t.me/cibsecurity/32016 · Telegram Post