ZAP-ESUP: ZAP Efficient Scanner for Server Side Template Injection Using Polyglots

November 9, 2018

Recently, Kettle introduced a new type of vulnerability which he called SSTI. Template engine is software used to combine data models with templates which contain both static HTML and template code. This template code defines how the dynamic HTML is generated depending on the given data model, and some allow full programming language functionality. If the user input is incorrectly inserted in the middle of the template instead of being used as the data model, an attacker can execute code in the server. SSTI can be considered an A1-Injection that is the class with the highest security risk according to OWASP Top 10 2017. To the best of my knowledge only 2 solutions detect or exploit SSTI, Burp Suite and Tplmap. These solutions are either proprietary software or have a limited amount of (fixed) payloads and consequently restricted to a limited number of template engines. None of them can find vulnerabilities when the input is stored and used in other pages (Stored SSTI). In this work, I studied the situations where SSTI may be present, developed a scanner that automatically detects SSTI vulnerabilities in a broader range of situations (reflected, stored, and blind),introduced an efficient technique that uses polyglot payloads to detect SSTI with less than 25% of the requests made by the other scanners, and concluded by constructing and using tests to compare with the existent solutions. The solution will be made available as a plug-in for OWASP ZAP a widely used open-source to find vulnerabilities in web applications.

Autores da comunidade :

• 

  D

  Diogo Miguel Reis Silva

  ist179039

Orientadores desta instituição:

• 

  P

  Pedro Miguel dos Santos Alves Madeira Adão

  ist14151

electrical-engineering-electronic-engineering-information-engineering - Engenharia Eletrotécnica, Eletrónica e Informática

eng - Inglês

Instituto Superior Técnico