CVE-2020-12827: 
JavaScript vulnerability analysis and mitigation

MJML (Mailjet Markup Language) versions prior to 4.6.3 contain a path traversal vulnerability when processing the mj-include directive within an MJML document. The vulnerability was discovered on April 28, 2020, and publicly disclosed on June 14, 2020. This security issue affects all versions of MJML up to and including version 4.6.2 (Full Disclosure, CISA Bulletin).

The vulnerability exists in the mj-include component, which allows external MJML files to be included into email templates using its 'path' attribute. The application fails to properly validate the value supplied to the 'path' argument, enabling directory traversal attacks. The vulnerability has been assigned a CVSSv3 score of 7.2 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L) indicating a high severity issue (Full Disclosure).

The vulnerability can be exploited to leak sensitive information about the server such as local server paths and contents of compressed/binary files, or cause denial of service conditions. Specifically, attackers can leak local server paths by pointing to non-existent MJML files, enumerate local server files using a true/false approach, partially read local binary server files, and cause denial of service by reading system files like /dev/urandom (Full Disclosure).

The vulnerability can be exploited by both unauthenticated and authenticated attackers, depending on how MJML is embedded in the application. The attack requires no special conditions or user interaction to be successful (Full Disclosure).

The vulnerability was addressed in MJML version 4.6.3 by introducing the 'ignoreIncludes' directive, which is set to false by default. Users should update to version 4.6.3 or later and ensure the 'ignoreIncludes' setting remains disabled (GitHub Commit, GitHub Release).