ZAP-ESUP: ZAP Efficient Scanner for Server Side Template Injection Using Polyglots

Diogo Miguel Reis Silva

Key information

Authors:

Diogo Miguel Reis Silva (Diogo Miguel Reis Silva)

Supervisors:

Pedro Miguel dos Santos Alves Madeira Adão (Pedro Miguel dos Santos Alves Madeira Adão)

Published in

November 9, 2018

Abstract

Recently, Kettle introduced a new type of vulnerability which he called SSTI. Template engine is software used to combine data models with templates which contain both static HTML and template code. This template code defines how the dynamic HTML is generated depending on the given data model, and some allow full programming language functionality. If the user input is incorrectly inserted in the middle of the template instead of being used as the data model, an attacker can execute code in the server. SSTI can be considered an A1-Injection that is the class with the highest security risk according to OWASP Top 10 2017. To the best of my knowledge only 2 solutions detect or exploit SSTI, Burp Suite and Tplmap. These solutions are either proprietary software or have a limited amount of (fixed) payloads and consequently restricted to a limited number of template engines. None of them can find vulnerabilities when the input is stored and used in other pages (Stored SSTI). In this work, I studied the situations where SSTI may be present, developed a scanner that automatically detects SSTI vulnerabilities in a broader range of situations (reflected, stored, and blind),introduced an efficient technique that uses polyglot payloads to detect SSTI with less than 25% of the requests made by the other scanners, and concluded by constructing and using tests to compare with the existent solutions. The solution will be made available as a plug-in for OWASP ZAP a widely used open-source to find vulnerabilities in web applications.