CVE-2020-12827
📋 TL;DR
CVE-2020-12827 is a path traversal vulnerability in MJML email framework versions prior to 4.6.3. Attackers can exploit the mj-include directive to read arbitrary files on the server. This affects any application using vulnerable MJML versions to process user-controlled MJML templates.
💻 Affected Systems
- MJML
📦 What is this software?
Mjml by Mjml
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive files like configuration files, SSH keys, or database credentials, potentially leading to lateral movement and data exfiltration.
Likely Case
Unauthorized file disclosure including source code, configuration files, or sensitive user data stored on the server.
If Mitigated
Limited impact with proper input validation and file system permissions restricting access to sensitive directories.
🎯 Exploit Status
Public proof-of-concept available in Packet Storm Security disclosure. Exploitation requires ability to submit MJML templates for processing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.6.3
Vendor Advisory: https://github.com/mjmlio/mjml/releases/tag/v4.6.3
Restart Required: No
Instructions:
1. Update MJML to version 4.6.3 or later using npm: npm update mjml
2. Verify the update with: npm list mjml
3. Test MJML template processing functionality
🔧 Temporary Workarounds
Input Validation
allImplement strict validation on mj-include paths to prevent directory traversal sequences
File System Restrictions
allRun MJML in a sandboxed environment with restricted file system access
🧯 If You Can't Patch
- Disable mj-include directive processing for user-controlled templates
- Implement web application firewall rules to block path traversal patterns in MJML input
🔍 How to Verify
Check if Vulnerable:
Check MJML version: npm list mjml | grep mjml. If version is below 4.6.3, system is vulnerable.Check Version:
npm list mjml | grep mjmlVerify Fix Applied:
After updating, verify version is 4.6.3 or higher: npm list mjml | grep mjml📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in MJML processing logs
- Multiple failed attempts to access restricted files
Network Indicators:
- HTTP requests containing path traversal sequences in MJML payloads
SIEM Query:
source="mjml_logs" AND (path="../" OR path="..\\" OR path="%2e%2e%2f")🔗 References
- http://packetstormsecurity.com/files/158111/MJML-4.6.2-Path-Traversal.html
- http://seclists.org/fulldisclosure/2020/Jun/23
- https://github.com/mjmlio/mjml/commit/30e29ed2cdaec8684d60a6d12ea07b611c765a12
- https://github.com/mjmlio/mjml/releases/tag/v4.6.3
- https://mjml.io/community
- https://rcesecurity.com
- https://twitter.com/mjmlio
- http://packetstormsecurity.com/files/158111/MJML-4.6.2-Path-Traversal.html
- http://seclists.org/fulldisclosure/2020/Jun/23
- https://github.com/mjmlio/mjml/commit/30e29ed2cdaec8684d60a6d12ea07b611c765a12
- https://github.com/mjmlio/mjml/releases/tag/v4.6.3
- https://mjml.io/community
- https://rcesecurity.com
- https://twitter.com/mjmlio
