Jte Template Engine Cross-Site Scripting Vulnerability in HTML Templates with Script Tags

A cross-site scripting (XSS) vulnerability exists in the Jte (Java Template Engine) HTML templates rendered with 'OwaspHtmlTemplateOutput' in versions through 3.1.15. The issue arises when templates include 'script' tags or script attributes containing JavaScript template strings (backticks). The 'javaScriptBlock' and 'javaScriptAttribute' methods in the 'Escape' class fail to properly escape backticks and dollar signs, which are crucial for JavaScript template string interpolation. As a result, malicious JavaScript can be injected and executed.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject and execute malicious scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, create a Jte HTML template that includes a 'script' tag or a script attribute with a JavaScript template string (backticks). Then, render the template using Jte's 'OwaspHtmlTemplateOutput' version 3.1.15 or earlier. The injected script will be executed, demonstrating the cross-site scripting vulnerability.

Remediation

Users should upgrade to Jte version 3.1.16 or later, where this vulnerability has been addressed.