CVE-2021-46703: RazorEngine Sandbox Escape RCE Vulnerability

CVE-2021-46703 Overview

CVE-2021-46703 is a critical arbitrary code execution vulnerability affecting the IsolatedRazorEngine component of Antaris RazorEngine through version 4.5.1-alpha001. The vulnerability allows attackers to execute arbitrary .NET code within a sandboxed environment when users can externally control template contents. This is particularly concerning for applications that process user-supplied Razor templates.

Critical Impact

Attackers can achieve remote code execution by injecting malicious .NET code through externally controlled template contents, potentially leading to complete system compromise. Note that this vulnerability affects a product that is no longer supported by the maintainer.

Affected Products

• Antaris RazorEngine through version 4.5.1-alpha001
• RazorEngine IsolatedRazorEngine component
• Applications using RazorEngine with user-controlled template inputs

Discovery Timeline

• 2022-03-06 - CVE CVE-2021-46703 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-46703

Vulnerability Analysis

The vulnerability resides in the IsolatedRazorEngine component of Antaris RazorEngine, a popular .NET templating library that allows developers to use Razor syntax outside of ASP.NET MVC. The core issue stems from insufficient sandboxing of template execution when external users can control template contents.

RazorEngine is designed to compile and execute Razor templates dynamically at runtime. The IsolatedRazorEngine was intended to provide a sandboxed execution environment for templates, adding a layer of security when processing potentially untrusted content. However, the sandbox implementation contains flaws that allow attackers to break out and execute arbitrary .NET code.

When an application accepts user-controlled input that gets processed as a Razor template, an attacker can craft malicious template content that escapes the sandbox restrictions. This enables execution of arbitrary .NET assemblies and system commands, effectively bypassing the security controls that IsolatedRazorEngine was designed to provide.

The impact is severe as successful exploitation grants attackers the ability to execute code with the privileges of the application process, potentially leading to data theft, lateral movement, or complete system compromise.

Root Cause

The root cause of CVE-2021-46703 lies in the inadequate isolation mechanisms within the IsolatedRazorEngine sandbox. The component fails to properly restrict access to dangerous .NET Framework features and assemblies from within compiled templates. Specifically, the sandbox does not sufficiently prevent templates from:

• Accessing reflection APIs to invoke arbitrary methods
• Loading and executing external assemblies
• Interacting with system resources outside the intended sandbox boundary

This architectural flaw means that even though the code executes within what is intended to be a sandboxed environment, attackers can leverage built-in .NET capabilities to escape the sandbox and gain full code execution privileges.

Attack Vector

The attack vector for this vulnerability is network-based with no authentication required. An attacker who can supply template content to an application using the vulnerable IsolatedRazorEngine component can exploit this flaw. Common attack scenarios include:

1. Web applications that allow users to customize templates or create dynamic content using Razor syntax
2. Email templating systems where user input influences template generation
3. Reporting systems that process user-defined templates
4. Any application that passes externally-controlled strings to RazorEngine for compilation and execution

The exploitation mechanism involves crafting a malicious Razor template that contains embedded .NET code designed to break out of the sandbox. When the application compiles and executes this template, the malicious code runs with the full privileges of the hosting process.

For technical details on the vulnerability mechanics, refer to the GitHub Issue Discussion where this security concern was reported.

Detection Methods for CVE-2021-46703

Indicators of Compromise

• Unexpected process spawning from applications using RazorEngine
• Unusual network connections originating from .NET application processes
• Log entries showing template compilation errors or exceptions related to reflection
• Evidence of unauthorized file system access or modification by RazorEngine-dependent applications
• Memory artifacts indicating code injection or assembly loading outside normal operations

Detection Strategies

• Monitor application logs for template compilation errors or suspicious template content patterns
• Implement runtime application self-protection (RASP) to detect code execution attempts within templating contexts
• Use static analysis tools to identify code paths where user input flows into RazorEngine template compilation
• Deploy endpoint detection and response (EDR) solutions to identify anomalous behavior from .NET applications

Monitoring Recommendations

• Enable verbose logging for applications using RazorEngine to capture template processing events
• Configure alerting for unusual .NET assembly loading or reflection API usage
• Monitor for process creation events where the parent is a known RazorEngine-dependent application
• Implement network segmentation and monitor for unexpected outbound connections from affected systems

How to Mitigate CVE-2021-46703

Immediate Actions Required

• Audit applications to identify usage of Antaris RazorEngine, particularly the IsolatedRazorEngine component
• Evaluate whether user-controlled input can influence template content in affected applications
• Consider migrating to actively maintained alternatives such as Microsoft's Razor SDK or other secure templating engines
• Implement strict input validation and sanitization for any content that may be processed as templates

Patch Information

This vulnerability affects Antaris RazorEngine through version 4.5.1-alpha001. It is important to note that RazorEngine is no longer actively maintained by the original developers. As such, no official patch is available. Organizations using this library should prioritize migration to supported alternatives.

For more information on this vulnerability and community discussion, see the GitHub Issue Discussion.

Workarounds

• Remove or disable the ability for users to supply custom template content where possible
• Implement a strict allowlist of permitted template constructs and validate all input against this list
• Run applications using RazorEngine with minimal privileges following the principle of least privilege
• Isolate affected applications using containerization or network segmentation to limit blast radius
• Consider implementing a custom pre-processor to strip potentially dangerous code patterns from templates

# Example: Identify RazorEngine usage in .NET projects
# Search for RazorEngine package references in project files
grep -r "RazorEngine" --include="*.csproj" --include="packages.config" ./

# Check for IsolatedRazorEngine usage in source code
grep -r "IsolatedRazorEngine" --include="*.cs" ./