ejs-2.7.4.tgz: 2 vulnerabilities (highest severity is: 9.8) [master] (reachable)

[mend-developer-platform-dev]

📂 Vulnerable Library - ejs-2.7.4.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-2.7.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ejs/package.json

Findings

Finding	Severity	🎯 CVSS	Exploit Maturity	EPSS	Library	Type	Fixed in	Remediation Available	Reachability
WS-2021-0153	🟣 Critical	9.8	N/A	N/A	ejs-2.7.4.tgz	Direct	ejs - 3.1.6	✅	Reachable
CVE-2022-29078	🟣 Critical	9.3	Not Defined	93.5%	ejs-2.7.4.tgz	Direct	ejs - 3.1.7	✅	Reachable

Details

🟣WS-2021-0153

Vulnerable Library - ejs-2.7.4.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-2.7.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ejs/package.json

Dependency Hierarchy:

• ❌ ejs-2.7.4.tgz (Vulnerable Library)

---

Reachability Analysis

This vulnerability is potentially reachable:

- dvna-0.0.1/server.js (Application)
    -> ❌ ejs-2.7.4/lib/ejs.js (Vulnerable Component)

---

Vulnerability Details

Arbitrary Code Injection vulnerability was found in ejs before 3.1.6. Caused by filename which isn't sanitized for display.

Publish Date: Jan 22, 2021 12:00 AM

URL: WS-2021-0153

Threat Assessment

Exploit Maturity:N/A

EPSS:N/A

Score: 9.8

---

Suggested Fix

Type: Upgrade version

Origin: mde/ejs#571

Release Date: Jan 22, 2021 12:00 AM

Fix Resolution : ejs - 3.1.6

🟣CVE-2022-29078

Vulnerable Library - ejs-2.7.4.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-2.7.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ejs/package.json

Dependency Hierarchy:

• ❌ ejs-2.7.4.tgz (Vulnerable Library)

---

Reachability Analysis

This vulnerability is potentially reachable:

- dvna-0.0.1/server.js (Application)
    - ejs-2.7.4/lib/ejs.js (Extension)
        -> ❌ ejs-2.7.4/lib/utils.js (Vulnerable Component)

---

Vulnerability Details

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).

Publish Date: Apr 25, 2022 02:13 PM

URL: CVE-2022-29078

Threat Assessment

Exploit Maturity:Not Defined

EPSS:93.5%

Score: 9.3

---

Suggested Fix

Type: Upgrade version

Origin: GHSA-phwq-j96m-2c2q

Release Date: Apr 25, 2022 02:13 PM

Fix Resolution : ejs - 3.1.7