Remote code execution in squirrelly
90Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 8epss 60%
from disclosure to weapon29 days
Published on NVDMay 14
1st PoC+29d
VulnCheck+999d
exploitation probability
60%top 1% of all CVEs
observed exploitation
yesVulnCheck
1 public exploit(s)
Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. This issue is fixed in version 9.0.0. For complete details refer to the referenced GHSL-2021-023.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected products
squirrellyjs · squirrellypublic PoCs found — 1
vulncheckvulncheck.com/xdb/f68321f523e6unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://github.com/squirrellyjs/squirrelly/commit/c12418a026f73df645ba927fd29358efe02fed1ehttps://github.com/squirrellyjs/squirrelly/commit/dca7a1e7ee91d8a6ffffb655f3f15647486db9dahttps://github.com/squirrellyjs/squirrelly/pull/254https://securitylab.github.com/advisories/GHSL-2021-023-squirrelly/