CVE-2021-32819: Squirrelly Template Engine RCE Vulnerability

CVE-2021-32819 Overview

CVE-2021-32819 is a Remote Code Execution (RCE) vulnerability affecting Squirrelly, a JavaScript template engine designed to work seamlessly with ExpressJS. The vulnerability arises from the unsafe mixing of pure template data with engine configuration options through the Express render API. By overwriting internal configuration options, attackers can trigger remote code execution in downstream applications that utilize Squirrelly for template rendering.

Critical Impact

Remote attackers can achieve arbitrary code execution on vulnerable servers by manipulating template configuration options, potentially leading to complete system compromise.

Affected Products

• Squirrelly versions prior to 9.0.0
• Squirrelly version 8.0.8 (confirmed vulnerable)
• Applications using Squirrelly with ExpressJS render API

Discovery Timeline

• 2021-05-14 - CVE-2021-32819 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-32819

Vulnerability Analysis

The vulnerability exists in how Squirrelly processes data objects passed through the Express render API. The template engine failed to properly isolate user-controlled template data from internal configuration settings. When rendering templates, Squirrelly would merge user-supplied data including a settings property directly into the configuration object, allowing attackers to override critical engine options that control code execution behavior.

This design flaw creates an injection point where malicious input can modify how the template engine processes and executes template code. The vulnerability is particularly dangerous in web applications where user input is passed to template rendering functions without adequate validation, enabling attackers to craft payloads that override internal settings and achieve code execution on the server.

Root Cause

The root cause stems from improper input validation in the file handlers component. The vulnerable code would accept a settings property from the data object and merge it directly into the engine's configuration using a copyProps utility function. This allowed external data to contaminate internal engine state.

The fix removed the settings interface from the DataObj type definition and eliminated the use of copyProps for merging view options, ensuring that user-supplied data cannot influence engine configuration.

Attack Vector

The attack leverages the Express render API integration where Squirrelly processes user-controlled data objects. An attacker can craft a malicious request containing configuration-overriding properties that, when processed by the template engine, modify execution behavior to achieve remote code execution.

The attack requires user interaction (such as visiting a crafted URL or submitting a malicious form), but can be executed remotely over the network without authentication. Once successful, the attacker gains the ability to execute arbitrary code with the privileges of the Node.js application process.

// Security patch removing settings interface from DataObj
// Source: https://github.com/squirrellyjs/squirrelly/commit/c12418a026f73df645ba927fd29358efe02fed1e

 }
 
 interface DataObj {
-  settings?: {
-    [key: string]: any
-  }
   [key: string]: any
 }
 

// Security patch removing copyProps import for view options handling
// Source: https://github.com/squirrellyjs/squirrelly/commit/dca7a1e7ee91d8a6ffffb655f3f15647486db9da

 import compile from './compile'
 import { getConfig } from './config'
 import { getPath, readFile, loadFile } from './file-utils'
-import { promiseImpl, copyProps } from './utils'
+import { promiseImpl } from './utils'
 
 /* TYPES */
 

Detection Methods for CVE-2021-32819

Indicators of Compromise

• Unusual HTTP requests containing settings properties targeting template rendering endpoints
• Node.js application logs showing unexpected configuration changes or errors during template rendering
• Process spawning or network connections originating from the Node.js application that are not part of normal operation

Detection Strategies

• Monitor application logs for template rendering errors or unexpected behavior in Squirrelly-powered endpoints
• Implement Web Application Firewall (WAF) rules to detect and block requests containing suspicious settings objects in POST/GET parameters
• Deploy runtime application self-protection (RASP) solutions to detect configuration tampering attempts

Monitoring Recommendations

• Enable verbose logging for Express application template rendering operations
• Monitor for outbound network connections or process executions from the Node.js process that indicate post-exploitation activity
• Track dependency versions in package.json and alert on vulnerable Squirrelly versions

How to Mitigate CVE-2021-32819

Immediate Actions Required

• Upgrade Squirrelly to version 9.0.0 or later immediately
• Audit all applications using Squirrelly with ExpressJS for potential exposure
• Review application code to ensure user input is not directly passed to template render functions without validation

Patch Information

The vulnerability has been fixed in Squirrelly version 9.0.0. The fix involves removing the ability for user-supplied data to override engine configuration options. The patches can be reviewed in the GitHub Pull Request #254 and associated commits. For complete technical details, refer to the GitHub Security Advisory GHSL-2021-023.

Workarounds

• If immediate upgrade is not possible, sanitize all user input before passing to Squirrelly render functions, specifically removing any settings properties from data objects
• Implement input validation middleware in Express to filter out configuration-like properties from request data
• Consider temporarily disabling dynamic template rendering features that accept user input until the upgrade can be completed

# Update Squirrelly to patched version
npm update squirrelly@^9.0.0

# Or install the specific patched version
npm install squirrelly@9.0.0 --save

# Verify installed version
npm list squirrelly