CVE-2023-23630
📋 TL;DR
CVE-2023-23630 is a cross-site scripting (XSS) vulnerability in the Eta JavaScript templating engine when used with Express API. Attackers can inject malicious scripts that execute in users' browsers when viewing rendered templates. Anyone using Eta with Express is affected.
💻 Affected Systems
- Eta JavaScript templating engine
📦 What is this software?
Eta by Eta.js
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of user sessions, credential theft, defacement of web applications, and potential pivot to internal systems.
Likely Case
Session hijacking, credential theft, and client-side data exfiltration from affected users.
If Mitigated
Limited impact with proper input validation and output encoding, though XSS could still affect users with elevated privileges.
🎯 Exploit Status
XSS vulnerabilities are commonly exploited; proof-of-concept exists in advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.0
Vendor Advisory: https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6
Restart Required: Yes
Instructions:
1. Update package.json to specify 'eta' version '^2.0.0'. 2. Run 'npm update eta' or 'yarn upgrade eta'. 3. Restart the application server.
🔧 Temporary Workarounds
Avoid direct user input in res.render
allDo not pass user-supplied data directly to res.render() without proper sanitization.
🧯 If You Can't Patch
- Implement strict input validation and output encoding for all user-supplied data passed to templates.
- Use Content Security Policy (CSP) headers to mitigate script execution impact.
🔍 How to Verify
Check if Vulnerable:
Check package.json or run 'npm list eta' to see if version is below 2.0.0.Check Version:
npm list eta | grep etaVerify Fix Applied:
Confirm eta version is 2.0.0 or higher via 'npm list eta' and test template rendering with sanitized inputs.📡 Detection & Monitoring
Log Indicators:
- Unusual template rendering errors
- Suspicious user input patterns in request logs
Network Indicators:
- Malicious script payloads in HTTP requests
- Unexpected external resource loads from rendered pages
SIEM Query:
source="web_server" AND (uri="*render*" OR message="*XSS*" OR message="*script*" )🔗 References
- https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd
- https://github.com/eta-dev/eta/releases/tag/v2.0.0
- https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6
- https://github.com/eta-dev/eta/commit/5651392462ee0ff19d77c8481081a99e5b9138dd
- https://github.com/eta-dev/eta/releases/tag/v2.0.0
- https://github.com/eta-dev/eta/security/advisories/GHSA-xrh7-m5pp-39r6
