CVE-2023-2142
📋 TL;DR
Nunjucks templating engine versions before 3.2.4 have an autoescape bypass vulnerability that allows cross-site scripting (XSS) attacks. When two user-controlled parameters appear on the same line in templates, attackers can inject malicious scripts using backslash characters. This affects any application using vulnerable Nunjucks versions to render user-supplied data.
💻 Affected Systems
- Nunjucks
📦 What is this software?
Nunjucks by Mozilla
⚠️ Risk & Real-World Impact
Worst Case
Attackers can execute arbitrary JavaScript in victims' browsers, potentially stealing session cookies, performing actions as authenticated users, or redirecting to malicious sites.
Likely Case
Reflected or stored XSS attacks leading to session hijacking, credential theft, or defacement of web applications.
If Mitigated
Limited impact if proper Content Security Policy (CSP) headers are implemented and user input validation is enforced.
🎯 Exploit Status
Exploitation requires user input to be reflected in templates with specific formatting. The vulnerability is well-documented in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.4
Vendor Advisory: https://github.com/mozilla/nunjucks/security/advisories/GHSA-x77j-w7wf-fjmw
Restart Required: Yes
Instructions:
1. Update Nunjucks dependency to version 3.2.4 or later. 2. Update package.json to specify 'nunjucks': '>=3.2.4'. 3. Run npm update or yarn upgrade. 4. Restart the application server.
🔧 Temporary Workarounds
Input Sanitization
allImplement server-side validation and sanitization of all user inputs before passing to templates.
Content Security Policy
allImplement strict CSP headers to mitigate XSS impact even if exploitation occurs.
🧯 If You Can't Patch
- Implement strict input validation to reject any input containing backslash characters in template parameters.
- Review all templates to ensure user-controlled parameters are not placed on the same line or implement custom escaping.
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for Nunjucks version. If version is below 3.2.4, the system is vulnerable.Check Version:
npm list nunjucks | grep nunjucksVerify Fix Applied:
After updating, verify the installed version is 3.2.4 or higher using npm list nunjucks or checking package.json.📡 Detection & Monitoring
Log Indicators:
- Unusual template rendering errors
- Requests containing backslash characters in parameters
Network Indicators:
- HTTP requests with suspicious JavaScript payloads in query parameters
SIEM Query:
source=web_logs AND (uri_query="*\\*" OR user_agent="*<script>*")