90036—Server Side Template Injection (Blind)

PUBLISHEDsecurity alertHigh

Active

Metadata

Alert ID:: 90036
Risk:: High
Type:: Active
CWE:: CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

摘要

When the user input is inserted in the template instead of being used as argument in rendering is evaluated by the template engine. Depending on the template engine it can lead to remote code execution.

解决方案

Instead of inserting the user input in the template, use it as rendering argument.

参考

browse all alerts