Content Injection due to quoteless attributes

Affecting mustache package, versions <2.2.1

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

When using attributes without quotes in a mustache template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting (XSS) vulnerability, assuming an attacker can influence the value entered into the template. If the mustache template is used to render user-generated content, this vulnerability may escalate to a persistent XSS vulnerability.

Example

For example, assume mustache was used to display user comments, using the following template: <a href={{email}}>{{name}}</a><pre>{{comment}}</pre>

If an attacker spoofed his email address and provided the following value: jane@evil.org onload=alert(document.cookie)

The resulting HTML would be: <a href=wizard@evil.org onload=alert(document.cookie)>Evil Wizard</a><pre>Busted!</pre>

References

Snyk patch available for versions:

CVSS Score

5.3
medium severity
  • Attack Vector
    Network
  • Attack Complexity
    Low
  • Privileges Required
    None
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    None
  • Integrity
    Low
  • Availability
    None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Credit
Matias P. Brutti
CVE
CVE-2015-8862
CWE
CWE-79
Snyk ID
npm:mustache:20151207
Disclosed
07 Dec, 2015
Published
14 Dec, 2015