CVE-2014-0013

Vulnerability

Ember.js versions 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 contain a cross-site scripting (XSS) vulnerability. The flaw arises when an application defines a template whose context is set to a user-supplied primitive value and the template also uses the {{this}} special Handlebars variable [1][2][3].

Exploitation

An attacker can trigger the vulnerability by supplying a malicious primitive value (e.g., a string) as the template context. When the template renders and references {{this}}, Handlebars may not properly escape the primitive value, allowing injection of arbitrary HTML or JavaScript. The attacker must find or create an endpoint in the application that renders a template with user-controlled context as a primitive [1][3].

Impact

Successful exploitation leads to cross-site scripting (XSS), enabling the attacker to execute arbitrary JavaScript in the context of the victim’s session. This can result in data theft, session hijacking, or other client-side attacks. The attacker does not need authentication if the vulnerable template is publicly accessible [1][3].

Mitigation

Users should upgrade to a fixed version: 1.0.1, 1.1.3, 1.2.1, 1.3.1, or 1.4.0-beta.2 and later. The fix was released on January 14, 2014, as noted in the Ember.js security announcement [3]. If upgrading immediately is not possible, applications should ensure that template contexts are never set to unsanitized user-supplied primitive values. No workaround other than patching is documented in the references.