CWE-1336Improper Neutralization of Special Elements Used in a Template Engine

Description

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

[object Object]

Common consequences

• Integrity→Execute Unauthorized Code or Commands
  If an attacker can influence input into a template before it is processed, then the attacker can invoke arbitrary expressions, i.e. perform injection attacks. For example, in some template languages, an attacker could inject the expression

Potential mitigations

• Architecture and Design
  Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands.
• Implementation
  Use the template engine's sandbox or restricted mode, if available.

Related CWEs

Recent CVEs classified under this CWE