Critical RCE Vulnerability Discovered in velocityjs Template Engine

A critical Remote Code Execution (RCE) vulnerability has been disclosed in velocityjs v2.1.6, a popular JavaScript template engine. This flaw allows attackers to achieve arbitrary code execution on servers by exploiting a previously unaddressed path in property-read expressions, effectively bypassing a fix implemented for an earlier prototype pollution vulnerability.

The discovery, detailed in a GitHub Security Advisory, highlights a significant risk for any web application within or outside the Minecraft ecosystem that utilizes velocityjs to render attacker-controlled templates. The RCE could lead to full server compromise, making immediate attention from developers and web service operators crucial.

Understanding the Vulnerability

velocityjs is a JavaScript library designed to parse and render templates, allowing dynamic content generation in web applications. Remote Code Execution vulnerabilities in such engines are particularly dangerous because they enable malicious actors to execute arbitrary code directly on the server hosting the application, often leading to data breaches, system compromise, or further network penetration.

The advisory specifically points to velocityjs version 2.1.6 as vulnerable. While the advisory originates from GitHub's Minecraft-related security advisories, the vulnerability itself is inherent to the velocityjs library and impacts any application using it, including those supporting Minecraft-related web services.

How the Bypass Works

The current RCE vulnerability is a bypass of the fix for GHSA-j658-c2gf-x6pq, which addressed a 'Prototype Pollution in #set path assignment' issue. The previous fix introduced isBlockedPathKey() to dist/cjs/compile/set.cjs, blocking critical keys like __proto__, constructor, and prototype when they were used as targets in a #set directive.

However, this blocking mechanism was incomplete. The isBlockedPathKey() check only validates the assignment target path, not the value expression being evaluated. The exploit chain leverages getReferences() in dist/cjs/compile/references.cjs, which calls getAttributes(). Within getAttributes(), the property access at references.cjs:88-89 (return baseRef[property.id];) lacks any filtering for these blocked keys.

This means that while an attacker could not directly assign to __proto__ or constructor using #set, they could still read properties like $x.constructor through an unfiltered property-read expression. This unfiltered access allows an attacker to obtain a reference to the Function constructor, which can then be used to execute arbitrary JavaScript code on the server.

Implications for Web Services

This RCE vulnerability poses a severe threat to any web service or application that uses velocityjs and processes untrusted input in its templates. Given the widespread use of JavaScript template engines in web development, many services, including those supporting Minecraft communities, servers, or tools, could be at risk if they are running the vulnerable version of velocityjs.

Attackers could potentially craft malicious templates that, when rendered by the server, execute arbitrary commands, allowing them to:

• Access sensitive data
• Modify or delete files
• Install backdoors
• Take control of the server

The fact that this is a bypass of a previous security fix underscores the complexity of securing template engines and the need for thorough security audits.

Why This Matters

For developers and operators of web services, particularly those within the Minecraft ecosystem, this vulnerability demands immediate attention. An RCE is among the most critical types of security flaws, offering attackers a direct path to server compromise.

• For Developers: If your application uses velocityjs, especially version 2.1.6, you must review how templates are processed. Any instance where velocityjs renders input that could originate from an untrusted source (e.g., user-submitted content, external APIs) is potentially vulnerable. Monitor the velocityjs project for official patches and update your dependencies as soon as a fix is available.
• For Web Service Operators: Ensure your development teams are aware of this advisory. Implement robust input validation and sanitization for all template inputs. Consider isolating services that render untrusted content in sandboxed environments to limit potential damage from such vulnerabilities.

Until a patch is released and applied, treating all velocityjs template inputs as potentially hostile and implementing strict content security policies are crucial steps to mitigate the risk of exploitation.

FAQ

Sources

• GitHub Security Advisories (Minecraft)