CVE-2022-29078
📋 TL;DR
CVE-2022-29078 is a critical server-side template injection vulnerability in the EJS package for Node.js that allows remote code execution. Attackers can inject arbitrary OS commands through the outputFunctionName option, which are executed during template compilation. This affects any Node.js application using vulnerable versions of the EJS templating engine.
💻 Affected Systems
- EJS (Embedded JavaScript templates)
📦 What is this software?
Ejs by Ejs
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining remote code execution, data exfiltration, lateral movement, and persistent backdoor installation.
Likely Case
Remote code execution leading to application takeover, sensitive data exposure, and potential deployment of malware or cryptominers.
If Mitigated
Limited impact due to proper input validation, sandboxing, and network segmentation preventing command execution.
🎯 Exploit Status
Exploitation is straightforward with publicly available proof-of-concept code. Attackers can execute arbitrary commands by injecting malicious payloads into the outputFunctionName parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.7 and later
Vendor Advisory: https://github.com/mde/ejs/releases
Restart Required: Yes
Instructions:
1. Update EJS package to version 3.1.7 or later using npm update ejs. 2. Restart the Node.js application. 3. Verify the update with npm list ejs.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict input validation to prevent user-controlled values from being passed to EJS template options.
Environment Hardening
allRun Node.js application with least privilege, disable unnecessary system commands, and implement network segmentation.
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block suspicious template injection patterns
- Isolate vulnerable applications in restricted network segments with no internet access
🔍 How to Verify
Check if Vulnerable:
Check package.json or run npm list ejs to see if version is 3.1.6 or earlierCheck Version:
npm list ejs | grep ejsVerify Fix Applied:
Confirm npm list ejs shows version 3.1.7 or later and test template functionality📡 Detection & Monitoring
Log Indicators:
- Unusual template compilation errors
- Suspicious command execution in application logs
- Abnormal process spawning from Node.js
Network Indicators:
- Outbound connections to suspicious IPs from Node.js process
- Unexpected data exfiltration patterns
SIEM Query:
source="application.logs" AND ("outputFunctionName" OR "EJS" OR "template injection") AND severity="critical"🔗 References
- https://eslam.io/posts/ejs-server-side-template-injection-rce/
- https://github.com/mde/ejs/releases
- https://security.netapp.com/advisory/ntap-20220804-0001/
- https://eslam.io/posts/ejs-server-side-template-injection-rce/
- https://github.com/mde/ejs/releases
- https://security.netapp.com/advisory/ntap-20220804-0001/
