REDHAT-BUG-2452521: High severity Handlebars Handlebars vulnerability
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in resolvePartial() and cause invokePartial() to return undefined. The Handlebars runtime then treats the unresolved partial as a source that needs to be compiled, passing the crafted object to env.compile(). Because the object is a valid Handlebars AST containing injected code, the generated JavaScript executes arbitrary commands on the server. The attack requires the adversary to control a value that can be returned by a dynamic partial lookup. Version 4.7.9 fixes the issue. Some workarounds are available. First, use the runtime-only build (require('handlebars/runtime')). Without compile(), the fallback compilation path in invokePartial is unreachable. Second, sanitize context data before rendering: Ensure no value in the context is a non-primitive object that could be passed to a dynamic partial. Third, avoid dynamic partial lookups ({{> (lookup ...)}}) when context data is user-controlled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
handlebarsto a version that resolves this vulnerability.Fixed in 4.7.9 - Configuration
Use the runtime-only build of Handlebars (use require('handlebars/runtime') instead of the full build) to reduce exposure from template/code execution paths.
Handlebars Build/require target = require('handlebars/runtime') - Configuration
Before rendering, sanitize the template context so that no value is a non-primitive object; prevent objects from being passed into dynamic partial resolution/compilation paths.
Template rendering context Context data types = Only primitives allowed (no non-primitive objects) - Configuration
Avoid dynamic partial lookups such as {{> (lookup ...)}} when the lookup inputs/context data are user-controlled.
Handlebars templates Dynamic partial lookups = Avoid {{> (lookup ...)}} with user-controlled context
Event History
Frequently Asked Questions
What conditions must be present for exploitation?
An attacker must be able to control a value returned by a dynamic partial lookup. The vulnerable path involves dynamic partials such as {{> (lookup ...)}} and context data containing a crafted non-primitive object.
Which versions require remediation?
Handlebars versions 4.0.0 through 4.7.8 are affected. Version 4.7.9 fixes the issue.
What can be done if upgrading is not immediately possible?
Use the runtime-only build, require('handlebars/runtime'), so the fallback compilation path is unreachable. Also sanitize rendering context data so dynamic partial lookups cannot receive non-primitive objects, or avoid dynamic partial lookups when context data is user-controlled.