Description
ExpressJs used with Handlebars as templating engine (invoked via hbs view engine) is vulnerable to a Local File Read vulnerabilty that allows an attacker to read arbitrary files using the layout parameter. The vulnerability appears when code like the example below is used:
var express = require('express');
var router = express.Router();
router.get('/', function(req, res, next) {
res.render('index')
});
router.post('/', function(req, res, next) {
var profile = req.body.profile
res.render('index', profile)
});
module.exports = router;
The problem lies with the following line of code:
res.render('index', profile)
.
Remediation
Use the code pattern
res.render('index', { profile }) instead of res.render('index', profile)
References
Related Vulnerabilities
WordPress Plugin BackupBuddy Arbitrary File Download (8.7.4.1)
WordPress Plugin zM Ajax Login & Register Multiple Vulnerabilities (1.0.9)
Oracle JavaServer Faces multiple vulnerabilities
WordPress Plugin OPS Old Post Spinner 'ops_file' Parameter Local File Include (2.2.1)
WordPress Plugin SE HTML5 Album Audio Player Directory Traversal (1.1.0)