High severity - Improper Control of Generation of Code ('Code Injection') vulnerability in pug-code-gen (package.json)

[github-actions]

• Package Manager: npm
• Vulnerable module: pug-code-gen
• Introduced through: juice-shop@12.3.0, pug@3.0.2 and others

Detailed paths

• Introduced through: juice-shop@12.3.0 › pug@3.0.2 › pug-code-gen@3.0.2

Overview

pug-code-gen is a Default code-generator for pug. It generates HTML via a JavaScript template function.

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') via the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked functions. An attacker can execute arbitrary JavaScript code by providing untrusted input.

Note:

These functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.

PoC

const express = require("express")
const pug = require("pug")
const runtimeWrap = require('pug-runtime/wrap');

const PORT = 3000

const app = express()

app.get("/", (req, res) => {
  const out = runtimeWrap(pug.compileClient('string of pug', req.query))
  res.send(out())
})

app.listen(PORT, () => {
  console.log(`Server is running on port ${PORT}`)
})

Remediation

Upgrade pug-code-gen to version 3.0.3 or higher.

References

• GitHub Commit
• GitHub PR
  
  SNYK-JS-PUGCODEGEN-7086056
  (CVE-2024-36361) pug-code-gen@3.0.2