Later archive addition

Handlebars template injection and RCE in a Shopify app

Mahmoud Gamal · Blogger · 4 April 2019

Researchers turn server-side Handlebars template injection into RCE by abusing JavaScript constructors, helpers, bind, and prototype mutation to build and invoke a Function body. They demonstrate the chain against Shopify’s Return Magic app and note the Handlebars fix blocking constructor access.

Record

Researcher

Mahmoud Gamal

Published by

Blogger

Date

4 April 2019

In the archive

• Added to the 2019 archive after the original list was published

Tags

• ssti
• rce
• javascript
• nodejs
• prototype-pollution
• sandbox-escape
• attack-chain
• owasp-a03-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Mahmoud Gamal, first published at the original source. Preserved copies are kept so the citation survives its host.