Skip to content

Nunjucks autoescape bypass leads to cross site scripting

Moderate
fkiriakos07 published GHSA-x77j-w7wf-fjmw Apr 19, 2023

Package

npm nunjucks (npm)

Affected versions

< 3.2.4

Patched versions

3.2.4

Description

Impact

In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash \ character.

Example

If the user-controlled parameters were used in the views similar to the following:

<script>
let testObject = { lang: '{{ lang }}', place: '{{ place }}' };
</script>

It is possible to inject XSS payload using the below parameters:

https://<application-url>/?lang=jp\&place=};alert(document.domain)//

Patches

The issue was patched in version 3.2.4.

References

Severity

Moderate

CVE ID

CVE-2023-2142

Weaknesses

Credits