Advisory details:
github_osv / GHSA-p75g-cxfj-7wrx
| Advisory ID | github_osv/GHSA-p75g-cxfj-7wrx |
| Aliases |
CVE-2025-1686
|
| Summary | Pebble has Arbitrary Local File Inclusion (LFI) Vulnerability via `include` macro ### Summary If untrusted user input is used to dynamically create a `PebbleTemplate` with the method `PebbleEngine#getLiteralTemplate`, then an attacker can include arbitrary local files from the file system into the generated template, leaking potentially sensitive information into the output of `PebbleTemplate#evaluate`. This is done via the `include` macro. ### Details The `include` macro calls `PebbleTempateImpl#resolveRelativePath` with the `relativePath` argument passed within the template: Example template: ``` {% include [relativePath] %} ``` When `resolveRelativePath` is called, the `relativePath` is resolved against the `PebbleTemplateImpl.name` variable. ```java /** * This method resolves the given relative path based on this template file path. * * @param relativePath the path which should be resolved. * @return the resolved path. */ public String resolveRelativePath(String relativePath) { String resolved = this.engine.getLoader().resolveRelativePath(relativePath, this.name); if (resolved == null) { return relativePath; } else { return resolved; } } ``` https://github.com/PebbleTemplates/pebble/blob/82ad7fcf9e9eaa45ee82ae3335a1409d19c10263/pebble/src/main/java/io/pebbletemplates/pebble/template/PebbleTemplateImpl.java#L380 Unfortunately, when the template is created from a string, as is the case when `PebbleEngine#getLiteralTemplate` is used, the `PebbleTemplateImpl.name` variable is actually the entirety of the contents of the template, not a filename as the logic expects. The net result is that the `relativePath` is resolved against the system root directory. As a result, files accessible from the root directory of the filesystem can be included into a template. ### PoC The following test demonstrates the vulnerability: ```java PebbleEngine e = new PebbleEngine.Builder().build(); String templateString = """ {% include '/etc/passwd' %} """; PebbleTemplate template = e.getLiteralTemplate(templateString); try (final Writer writer = new StringWriter()) { template.evaluate(writer, new HashMap<>()); System.out.println(writer); } ``` As an attacker, the following malicious template demonstrates the vulnerability: ``` {% include '/etc/passwd' %} ``` ### Impact This is an arbitrary Local File Inclusion (LFI) vulnerability. It can allow attackers to exfiltrate the contents of the local filesystem, including sensitive files into `PebbleTemplate` output. This can also be used to access the `/proc` filesystem which can give an attacker access to environment variables. ### Fix There exists no published fix for this vulnerability. The best way to mitigate this vulnerability is to disable the `include` macro in Pebble Templates. The following can safeguard your application from this vulnerability: ```java new PebbleEngine.Builder() .registerExtensionCustomizer(new DisallowExtensionCustomizerBuilder() .disallowedTokenParserTags(List.of("include")) .build()) .build(); ``` ### Report Timeline Vulnerability was reported under the Open Source Security Foundation (OpenSSF) [Model Outbound Vulnerability Disclosure Policy: Version 0.1](https://openssf.org/about/vulnerability-disclosure-policy/). - [Jul 15, 2024](https://github.com/PebbleTemplates/pebble/issues/680#issue-2409727829) Maintainer Contacted to enable private vulnerability reporting - [Jul 18, 2024](https://github.com/PebbleTemplates/pebble/issues/680#issuecomment-2236970984) I opened a GHSA to report this vulnerability to the maintainer https://github.com/PebbleTemplates/pebble/security/advisories/GHSA-7c6h-hmf9-7wj7 (private link) - Jul 29, 2024 GHSA updated to ping maintainer about vulnerability, no response - Oct 1, 2024 GHSA updated to ping maintainer about vulnerability, no response - Nov 15, 2024 GHSA updated to inform maintainer that disclosure timeline had lapsed, no response. - Feb 19, 2025 GHSA updated to inform maintainer that disclosure would occur imminently, no response. - Feb 24, 2025 this GHSA was created to disclose this vulnerability **without a patch available**. For further discussion, see this issue: https://github.com/PebbleTemplates/pebble/issues/688 ### Credit This vulnerability was discovered by @JLLeitschuh while at [Chainguard Labs](https://www.chainguard.dev). Jonathan is currently independent. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 6.3 |
| Risk | 3.1 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 6.8 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-p75g-cxfj-7wrx/GHSA-p75g-cxfj-7wrx.json |
| cvssv4 | 7.0 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-p75g-cxfj-7wrx/GHSA-p75g-cxfj-7wrx.json |
| generic_textual | HIGH |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-02-27T14:44:07Z/
Decision: Track
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2025/1xxx/CVE-2025-1686.json
Source Advisory: vulnrichment/CVE-2025-1686
[{'Exploitation': 'poc'},
{'Automatable': 'no'},
{'Technical Impact': 'partial'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]