Handlebars Template Injection Vulnerability

CVE-2019-20920

This demonstrates a critical Server-Side Template Injection (SSTI) vulnerability in Handlebars versions prior to 4.6.0.

The vulnerability allows attackers to execute arbitrary JavaScript code by injecting malicious template expressions that can bypass the built-in security mechanisms.

CVSS Score: 9.8 (Critical)

Vulnerability Type: Server-Side Template Injection (SSTI)

Fixed Version: 4.6.0

Current Version: 4.0.14

Demonstration

Enter a user profile that will be rendered using the vulnerable Handlebars template engine:

Try a malicious template like: {{#with "constructor"}}{{#with (lookup this "prototype")}}{{#with (lookup this "constructor")}}{{this "console.log('Handlebars SSTI')"}}{{/with}}{{/with}}{{/with}}

Result

Console Output:

No console output yet

Vulnerability status: Untested

About This Vulnerability

Server-Side Template Injection occurs when user input is concatenated into templates rather than passed in as data context.

The vulnerability in Handlebars allows attackers to bypass the sandboxing protections and access built-in JavaScript constructors to execute arbitrary code.

This can lead to remote code execution on the server, potentially allowing attackers to access sensitive information, modify data, or take control of the server.