Threats Tagged 'ghsa-grr9-747v-xvcp'

When Scriban renders an object that contains a circular reference, it traverses the object's members infinitely. Because the `ObjectRecursionLimit` property defaults to unlimited, this behavior exhausts the thread's stack space, triggering an uncatchable `StackOverflowException` that immediately terminates the hosting process. When rendering objects (e.g., `{{ obj }}`), the Scriban rendering engine recursively inspects and formats the object's properties. To prevent infinite loops caused by deeply nested or circular data structures, `TemplateContext` contains an `ObjectRecursionLimit` property. However, this property currently defaults to `0` (unlimited). If the data context pushed into the template contains a circular reference, the renderer will recurse indefinitely. This is especially dangerous for web applications that map user-controlled payloads (like JSON) directly to rendering contexts, or for applications that pass ORM objects (like Entity Framework models, which frequently contain circular navigation properties) into the template. #### Proof of Concept (PoC) The following C# code demonstrates the vulnerability. Executing this will cause an immediate, fatal `StackOverflowException`, bypassing any standard error handling. ```csharp using Scriban; using Scriban.Runtime; var template = Template.Parse("{{ a }}"); var context = new TemplateContext(); var a = new ScriptObject(); // Introduce a cycle a["self"] = a; context.PushGlobal(new ScriptObject { { "a", a } }); try { // This crashes the entire process immediately template.Render(context); } catch (Exception ex) { // This will never execute because StackOverflowException Console.WriteLine("Caught exception: " + ex.Message); } ``` #### Impact This vulnerability allows a Denial of Service (DoS) attack. If a malicious user can manipulate the data structure passed to the renderer to include a cyclic reference, or if the application passes a complex object graph to an untrusted template, the entire .NET hosting process will crash. #### Suggested Remediation Update `TemplateContext.cs` to set `ObjectRecursionLimit` to a safe default, such as `20`. ```csharp public int ObjectRecursionLimit { get; set; } = 20; ``` By implementing this default, circular references will gracefully result in a catchable `ScriptRuntimeException` rather than a fatal process crash.