CVE-2024-45390
📋 TL;DR
CVE-2024-45390 is a code injection vulnerability in the @blakeembrey/template JavaScript library that allows attackers to execute arbitrary code when they can control template names. This affects applications using vulnerable versions of this template library with untrusted input for template display names. Developers using this library in web applications or Node.js services are at risk.
💻 Affected Systems
- @blakeembrey/template
📦 What is this software?
Template by Blakeembrey
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or service disruption
Likely Case
Limited code execution within the application context, potentially allowing data access or privilege escalation
If Mitigated
No impact if untrusted input is not passed to template display names or display name feature is disabled
🎯 Exploit Status
Exploitation requires attacker to control template display name input
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.0
Vendor Advisory: https://github.com/blakeembrey/js-template/security/advisories/GHSA-q765-wm9j-66qj
Restart Required: Yes
Instructions:
1. Update package.json to require @blakeembrey/template version 1.2.0 or higher
2. Run npm update @blakeembrey/template
3. Restart your application
🔧 Temporary Workarounds
Disable display name feature
allAvoid using the display name parameter or ensure it only receives trusted input
Input validation
allImplement strict input validation for template display names
🧯 If You Can't Patch
- Remove or disable the display name feature entirely
- Implement strict input validation and sanitization for all template parameters
🔍 How to Verify
Check if Vulnerable:
Check package.json or package-lock.json for @blakeembrey/template version <1.2.0Check Version:
npm list @blakeembrey/templateVerify Fix Applied:
Verify @blakeembrey/template version is 1.2.0 or higher in package.json📡 Detection & Monitoring
Log Indicators:
- Unusual template processing errors
- Suspicious template names containing code-like patterns
Network Indicators:
- Unusual outbound connections from template processing services
SIEM Query:
source="application_logs" AND ("template error" OR "@blakeembrey/template") AND ("eval" OR "Function" OR suspicious_patterns)