Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-36361
CVE-2024-36361:
JavaScript vulnerability analysis and mitigation
Overview
Pug through version 3.0.2 contains a code injection vulnerability that allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileClientWithDependenciesTracked, and compileFileClient functions (NVD).
Technical details
The vulnerability exists in the compileClient family of functions where the options.name parameter is passed into templateName without proper validation. This allows attackers to inject arbitrary JavaScript code through template name manipulation. The vulnerability is particularly concerning when these functions are used in conjunction with user-controlled input being passed directly to the options object (GitHub PR).
Impact
If exploited, this vulnerability could lead to client-side arbitrary JavaScript execution, potentially resulting in Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks. In certain server-side configurations, it could even lead to Remote Code Execution (RCE) if the application exposes the vulnerable functions with user-controlled input (GitHub PR).
Mitigation and workarounds
The vulnerability has been patched in Pug version 3.0.3. Users should upgrade to this version or later. The fix includes additional validation checks to restrict template names to alphanumeric characters and underscores. For those unable to upgrade immediately, it's recommended to ensure that user input is not passed directly to the options object of the compile functions (GitHub PR).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management