CVE-2021-23369: Remote Code Execution (RCE) vulnerability in handlebars (npm)

What is CVE-2021-23369 About?

The handlebars package before version 4.7.7 is vulnerable to Remote Code Execution (RCE) when compiling templates from untrusted sources with specific compiling options. This allows an attacker to execute arbitrary code on the server. Exploitation requires control over template content and the use of vulnerable compilation settings.

Affected Software

handlebars
- <4.7.7
org.webjars:handlebars
- <4.7.7
org.webjars.npm:handlebars
- <4.7.7
org.webjars.bowergithub.wycats:handlebars.js
- <4.7.7

Technical Details

This vulnerability in the handlebars package, versions prior to 4.7.7, allows for Remote Code Execution (RCE). It occurs when certain compiling options are selected to compile templates that originate from an untrusted source. Specifically, if an attacker can provide a malicious template and the application processes it using handlebars with permissive or vulnerable compilation settings, the attacker can embed code within the template that will be executed server-side. This could be due to insecure templating engine configurations that allow for the inclusion of arbitrary JavaScript, leading to sandbox escapes or direct code execution during template compilation or rendering.

What is the Impact of CVE-2021-23369?

Successful exploitation may allow attackers to execute arbitrary code on the underlying system, leading to full system compromise, data theft, or complete unavailability of the service.

What is the Exploitability of CVE-2021-23369?

Exploitation of this RCE vulnerability requires an attacker to provide untrusted template content to an application using the vulnerable handlebars package with specific compiling options. The complexity is moderate to high, as it depends on both the attacker's ability to inject content and the specific configuration of the handlebars engine. Authentication and privilege requirements depend on how the application exposes template compilation functionality; it could be accessible to authenticated users or, in some cases, unauthenticated users if content is processed without prior validation. Remote exploitation is possible if the application processes user-supplied templates on a web server. The presence of proof-of-concept exploits increases the likelihood of attack.

What are the Known Public Exploits?

PoC Author	Link	Commentary
fazilbaig1	Link	Handlebars CVE-2021-23369 Vulnerability

What are the Available Fixes for CVE-2021-23369?

A Fix by Resolved Security Exists!

Fix open-source vulnerabilities without upgrading your dependencies.

About the Fix from Resolved Security

The patch fixes CVE-2021-23369 by ensuring property names used in template lookups are safely serialized using JSON.stringify, preventing crafted property names from escaping the intended lookup context. It also replaces direct object property access with container.lookupProperty, which implements safer lookup logic. These changes mitigate the risk of prototype pollution attacks via malicious template input.

Available Upgrade Options

org.webjars.npm:handlebars
- <4.7.7 → Upgrade to 4.7.7
handlebars
- <4.7.7 → Upgrade to 4.7.7
org.webjars.bowergithub.wycats:handlebars.js
- <4.7.7 → Upgrade to 4.7.7
org.webjars:handlebars
- <4.7.7 → Upgrade to 4.7.7

Struggling with dependency upgrades?

See how Resolved Security's drop-in replacements make it simple.

Book a demo

Additional Resources

What are Similar Vulnerabilities to CVE-2021-23369?

Similar Vulnerabilities: CVE-2020-13936 , CVE-2019-16781 , CVE-2018-1000006 , CVE-2017-1000048 , CVE-2016-10543

CVE-2021-23369 Remote Code Execution (RCE) vulnerability in handlebars (npm)