CVE-2021-32818
📋 TL;DR
CVE-2021-32818 is a template injection vulnerability in haml-coffee JavaScript templating engine that allows remote code execution and cross-site scripting. Applications that pass user-controlled data to haml-coffee templates are vulnerable. This affects any Node.js application using haml-coffee with Express render API.
💻 Affected Systems
- haml-coffee
📦 What is this software?
Haml Coffee by Haml Coffee Project
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains full server control through arbitrary code execution, leading to data theft, system compromise, and lateral movement.
Likely Case
Attackers execute malicious JavaScript in victim's browser through XSS or limited server-side code execution.
If Mitigated
Proper input validation and template configuration isolation prevent exploitation, limiting impact to application errors.
🎯 Exploit Status
Proof-of-concept available in GitHub Security Lab advisory. Exploitation requires specific application configuration but is straightforward once conditions are met.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: https://securitylab.github.com/advisories/GHSL-2021-025-haml-coffee/
Restart Required: No
Instructions:
No official fix available. Consider migrating to alternative templating engines or implementing strict input validation.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict validation of all user inputs before passing to haml-coffee templates
Template Configuration Isolation
allEnsure template configuration options are not exposed to user-controlled data
🧯 If You Can't Patch
- Implement WAF rules to detect and block template injection patterns
- Isolate haml-coffee instances in containerized environments with minimal privileges
🔍 How to Verify
Check if Vulnerable:
Check if application uses haml-coffee version ≤1.14.1 and passes user-controlled objects to template engineCheck Version:
npm list haml-coffeeVerify Fix Applied:
Verify no user-controlled data reaches haml-coffee configuration options📡 Detection & Monitoring
Log Indicators:
- Unusual template rendering errors
- Suspicious JavaScript execution in template contexts
Network Indicators:
- HTTP requests with template injection payloads
- Unexpected outbound connections from application server
SIEM Query:
source="application.log" AND ("haml-coffee" OR "template injection")