RubySec

Providing security resources for the Ruby community

OSVDB-131671 (mustache-js-rails): mustache.js - quoteless attributes in templates can lead to XSS

ADVISORIES

GEM

mustache-js-rails

PATCHED VERSIONS

  • >= 2.0.3

DESCRIPTION

The upstream 'mustache.js' node.js module was found to not properly escape backtick (`) and equals (=) characters, leading to possible content injection via attributes in templates.

Example:

  • Template: <a href={{foo}}/>
  • Input: { 'foo' : 'test.com onload=alert(1)'}
  • Rendered result: <a href=test.com onload=alert(1)/>

RELATED