Mitigating Scriban@5.9.0- CWE-770 | Allocation of Resources Without Limits or Throttling Vulnerability in ABP 8.2.3 Without Upgrading .NET #10733

2 Answer(s)

• 

  0

  AI-Bot created 3 months ago

  Support Team ABP Agent

  • In ABP 8.2.x, Scriban is used through ABP Text Templating (Scriban) integration. ABP already enables Scriban’s “safe runtime” boundaries (restricted globals, restricted .NET member access via MemberFilter, no TemplateLoader by default, and execution limits like LoopLimit, RecursiveLimit, LimitToString, etc.). However, the CVE you described is specifically about array.insert_at bypassing those limits, so tightening LoopLimit/LimitToString alone is not a sufficient mitigation for that specific issue.

  • The practical mitigation in ABP without upgrading .NET / Scriban is therefore to ensure untrusted template authors cannot execute Scriban templates (i.e., don’t allow end users/tenants to edit arbitrary Scriban templates in production), and keep Scriban templates developer-owned and embedded/controlled (virtual file system, deployed with code). In other words: treat Scriban templates as trusted code/config, not user input.

  • If you must allow users to edit templates (e.g., Text Template Management scenarios), then within ABP 8.2.x there is no verified, ABP-provided switch documented to disable only array.insert_at or to hard-cap its index to prevent the allocation behavior in Scriban 5.9.0. In that case, the only fully effective remediation is upgrading Scriban to a fixed version (which you noted is blocked by your runtime constraint). So the ABP-side mitigation is to avoid exposing Scriban editing to untrusted parties until you can move to a fixed Scriban line.

  • Recommended ABP usage pattern (safe-by-design):

    1. Keep templates embedded (or otherwise shipped with the application) and not editable by end users.
    2. Pass a pre-built Dictionary<string, object> / ScriptObject as the model so the template surface area stays minimal and controlled (ABP recommends this pattern).
    3. Do not wire a custom TemplateLoader unless you absolutely need include behavior.

  Sources (validated):

  • https://abp.io/docs/latest/framework/infrastructure/text-templating/scriban
  • https://abp.io/docs/10.4/framework/infrastructure/text-templating/scriban
  • https://abp.io/docs/latest/Text-Templating

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created 3 months ago

  Support Team Fullstack Developer

  Hi,

  A few things to clear up first:

  • Scriban 7.2.x does not require .NET 9. The package targets net8.0 and netstandard2.0, so your .NET 8 runtime is fine.
  • You can't pin Scriban to 7.x in your csproj on ABP 8.2.3 — same TypeLoadException as your earlier ticket https://abp.io/support/questions/10600#answer-3a20a31b-6032-e62f-8b26-51cae51edaf0. Pinning to 6.x doesn't help either, the advisory covers <= 7.1.0.

  In a default ABP setup the exploit is not reachable from outside. ABP's Scriban surface (email templates, report templates) is developer-authored and shipped through the Virtual File System — there's no public endpoint that lets end users submit template bodies. Even with the Volo.Abp.TextTemplateManagement module, editing template contents requires the TextTemplateManagement.TextTemplates.EditContents permission, which is admin-only by default. So if your app only renders templates and doesn't expose template editing to regular users, you're not actually exposed to this CVE — but you'll still see the NuGet audit warning because the package version is what gets scanned, not the call graph.

  If you want to block the exploit at the engine level anyway (recommended if you do let any non-admin user influence template content), override ScribanTemplateRenderingEngine and remove the unbounded array.insert_at builtin:

  using System.Collections.Generic;
  using Microsoft.Extensions.Localization;
  using Scriban;
  using Scriban.Runtime;
  using Volo.Abp.DependencyInjection;
  using Volo.Abp.TextTemplating;
  using Volo.Abp.TextTemplating.Scriban;
  
  [Dependency(ReplaceServices = true)]
  [ExposeServices(typeof(ScribanTemplateRenderingEngine))]
  public class MyScribanTemplateRenderingEngine : ScribanTemplateRenderingEngine
  {
      public MyScribanTemplateRenderingEngine(
          ITemplateDefinitionManager templateDefinitionManager,
          ITemplateContentProvider templateContentProvider,
          IStringLocalizerFactory stringLocalizerFactory)
          : base(templateDefinitionManager, templateContentProvider, stringLocalizerFactory)
      {
      }
  
      protected override TemplateContext CreateScribanTemplateContext(
          TemplateDefinition templateDefinition,
          Dictionary<string, object> globalContext,
          object? model = null)
      {
          var context = base.CreateScribanTemplateContext(templateDefinition, globalContext, model);
          if (context.BuiltinObject["array"] is ScriptObject arrayBuiltin)
          {
              arrayBuiltin.Remove("insert_at");
          }
          return context;
      }
  }
  

  After this, any template that tries array.insert_at throws ScriptRuntimeException: The function 'array.insert_at' was not found, while every other template keeps working unchanged.

  To clear the SAST/NuGetAudit warning on top of that, add the suppression (requires the .NET 8.0.400 SDK or newer):

  <ItemGroup>
    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-24c8-4792-22hx" />
  </ItemGroup>
  

  For the permanent fix we already bumped Scriban to 7.2.1 in the upcoming ABP 10.4 patch release (https://github.com/abpframework/abp/pull/25493). ABP 10.4 still targets net8.0, so picking it up is a framework upgrade, not a runtime one.

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel