Collected research
The Secret Parameter, LFR, and Potential RCE in NodeJS Apps
Express passes the whole render options object to the hbs view engine, which reads its layout property as a template path. A request body carrying a layout key therefore makes the server read and render an arbitrary file, giving local file read and, on old Handlebars versions, remote code execution. Prototype pollution can inject layout even when the app wraps its object.
Record
- Researcher
- CaptainFreak
- Published by
- CaptainFreak
- Topic
- Server
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of CaptainFreak, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .