CVE-2021-32822: GHSL-2021-020: File disclosure in hbs - CVE-2021-32822
The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. For an example PoC see the referenced GHSL-2021-020.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using the hbs npm package as an Express view engine may be exposed, depending on how they use the Express render API. The issue arises where template data can overwrite internal engine configuration options.
What does an attacker need to exploit the vulnerability?
The attacker must be able to influence template data supplied to the Express render API in a way that permits overwriting hbs internal configuration options. The provided CVSS vector indicates exploitation is network-accessible and requires no authentication or user interaction.
Is a patch available?
No. The available information states that there is currently no patch for this vulnerability.
What can be done if patching is not possible?
Avoid passing untrusted or attacker-controlled values as template data to hbs rendering calls, particularly where those values could overwrite engine configuration options. Review render API usage to keep template data separate from configuration.