CVE-2021-32819 : Squirrelly is a template engine implemented in JavaScript that works out of the

Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. This issue is fixed in version 9.0.0. For complete details refer to the referenced GHSL-2021-023.

Published 2021-05-14 19:15:08

Updated 2023-05-22 19:15:10

Source GitHub, Inc.

View at NVD, CVE.org

Vulnerability category: Execute codeInformation leak

Products affected by CVE-2021-32819

Squirrelly » Squirrelly » Version: 8.0.8
cpe:2.3:a:squirrelly:squirrelly:8.0.8:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-32819

EPSS FAQ

80.25%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 98 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-32819

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.8	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High
8.0	HIGH	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N	1.6	5.8	GitHub, Inc.
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: High Integrity: High Availability: None

CWE ids for CVE-2021-32819

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: security-advisories@github.com (Primary)

References for CVE-2021-32819

https://securitylab.github.com/advisories/GHSL-2021-023-squirrelly/

GHSL-2021-023: Remote code execution in squirrelly - CVE-2021-32819 | GitHub Security Lab
Exploit;Third Party Advisory
https://github.com/squirrellyjs/squirrelly/commit/c12418a026f73df645ba927fd29358efe02fed1e

Don't merge data.settings into the config option · squirrellyjs/squirrelly@c12418a · GitHub
https://github.com/squirrellyjs/squirrelly/pull/254

[security] Don't use data object for Squirrelly configuration by legobeat · Pull Request #254 · squirrellyjs/squirrelly · GitHub
https://github.com/squirrellyjs/squirrelly/commit/dca7a1e7ee91d8a6ffffb655f3f15647486db9da

don't pass view options · squirrellyjs/squirrelly@dca7a1e · GitHub

Jump to

Vulnerability Details : CVE-2021-32819

Products affected by CVE-2021-32819

Exploit prediction scoring system (EPSS) score for CVE-2021-32819

CVSS scores for CVE-2021-32819

CWE ids for CVE-2021-32819

References for CVE-2021-32819