Scriban Template Engine Array Multiplication DoS

Executive Summary

This is a denial-of-service vulnerability in the Scriban template engine affecting versions 3.0.0 through 7.2.0. The issue involves the array multiplication operator which allows an attacker to force a multi-gigabyte memory allocation by multiplying an array with a large integer. The operation does not enforce memory limits or use overflow-safe arithmetic, leading to resource exhaustion.

Useful 0 Not Useful 0

Detection Guidance

Check Scriban version with: grep -r "Scriban" --include="*.csproj" . or dotnet list package. Monitor for high memory usage during template processing. Look for ScriptRuntimeException or OutOfMemoryException in logs. Inspect templates for array multiplication operations like array * large_number.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to cause severe system slowdowns or crashes by consuming excessive memory. This may lead to application unavailability, process termination by the OS OOM-killer, or denial-of-service conditions affecting services relying on Scriban.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes system unavailability through resource exhaustion, which could lead to denial of service conditions. While not directly violating GDPR or HIPAA, such disruptions may impact compliance by preventing timely access to personal or health data as required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Scriban to version 7.2.1 or later. If upgrading is not possible, add LoopLimit enforcement or overflow-safe arithmetic checks to the array multiplication operator. Review and restrict template input to prevent large integer multipliers. Monitor system memory usage during template processing.

Useful 0 Not Useful 0