Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a vulnerability in the Scriban templating engine that, under specific conditions, could allow unintended access to sensitive data by reusing a template processing context. This bypasses intended security policies designed to protect information. The primary concern is confirming whether your applications utilize this technology and if the vulnerable functionality is exposed in a manner that could be exploited.
- A template engine flaw could expose hidden data.
- Understand if this technology is used in your systems.
- Confirm relevance and potential exposure.
Attack Path
How an attacker could exploit the issue
An attacker can exploit this vulnerability by crafting specific template requests that reuse a `TemplateContext`. By manipulating the `MemberFilter` after the `TypedObjectAccessor` has been cached, an attacker can bypass access controls and expose sensitive properties or fields that should have remained hidden. This could lead to unauthorized information disclosure or manipulation within the application.
- No authentication or special access needed.
- Reusing cached template contexts.
- Exposes sensitive data and bypasses policies.
Live Threat
Current exploitation, exposure, and threat context
When Scriban's template engine reuses `TemplateContext` instances, it may improperly expose members that should remain hidden due to insufficient consideration of `MemberFilter` changes. This could allow an attacker to bypass sandbox policies and access sensitive information.
- Access to filtered properties and fields.
- Reused `TemplateContext` bypasses filters.
- Potential sandbox policy violation.
Operational Fix
Recommended remediation, mitigation, and detection steps
To address this vulnerability, application owners and platform teams are likely responsible for managing the Scriban template engine. The first practical step is to identify all instances where Scriban is used, confirm if these instances are accessible externally or handle sensitive data, and then determine the accountable owner for each instance before planning remediation.
- Determine application owners and affected systems.
- Verify external reachability and business criticality.
- Plan remediation based on confirmed risk.
