Scriban Template Engine Stack Overflow via Unbounded Expression Depth

Executive Summary

This is a Denial of Service vulnerability in Scriban versions 6.6.0 through 7.2.0. It occurs because the ExpressionDepthLimit guard does not properly enforce limits on recursive parsing of deeply nested expressions. Attackers can exploit this by providing templates with excessive nesting like parentheses, arrays, or objects, causing an uncatchable StackOverflowException that crashes the host process.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system runs Scriban versions 6.6.0 through 7.2.0. Use commands like 'scriban --version' or inspect package dependencies in your project files. Monitor for crashes when processing templates with deeply nested structures.

Useful 0 Not Useful 0

Impact Analysis

If you use Scriban versions 6.6.0 to 7.2.0 in your application, an attacker could send a crafted template with deeply nested structures. This would crash your application with a single small request, causing downtime or service disruption. The impact is severe as it terminates the entire host process.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily causes denial-of-service by crashing the host process, which could lead to service unavailability. For GDPR, availability is a key principle, so prolonged outages may violate Article 32 requirements for resilience. HIPAA's Security Rule also mandates availability safeguards; however, this specific issue is not directly tied to data breaches or unauthorized access.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Scriban to a version beyond 7.2.0 where the ExpressionDepthLimit guard is enforced. If upgrading is not possible, implement input validation to reject templates with excessive nesting or disable template parsing from untrusted sources.

Useful 0 Not Useful 0