312-50V12 · Question #303
Calvin, a software developer, uses a feature that helps him auto-generate the content of a web page without manual involvement and is integrated with SSI directives. This leads to a vulnerability in…
The correct answer is D. Server-side includes injection. Calvin's web application is susceptible to Server-Side Includes (SSI) injection because it processes user-supplied input containing malicious SSI directives, leading to unauthorized server actions like file modification.
Question
Options
- ACRLF injection
- BServer-side template injection
- CServer-side JS injection
- DServer-side includes injection
How the community answered
(26 responses)- A4% (1)
- B8% (2)
- C4% (1)
- D85% (22)
Why each option
Calvin's web application is susceptible to Server-Side Includes (SSI) injection because it processes user-supplied input containing malicious SSI directives, leading to unauthorized server actions like file modification.
CRLF injection involves injecting Carriage Return (CR) and Line Feed (LF) characters to manipulate HTTP headers or log entries, not to execute server-side commands via directives.
Server-side template injection targets template engines (e.g., Jinja2, Twig) to execute malicious code within the template context, which is different from exploiting SSI directives.
Server-side JS injection typically refers to vulnerabilities in server-side JavaScript environments, such as Node.js, allowing code execution often through insecure deserialization or evaluation functions, not through SSI directives.
Server-side includes (SSI) injection occurs when a web application insecurely processes user-supplied input as part of a web page that is parsed by an SSI processor. By injecting malicious SSI directives, attackers can force the server to execute arbitrary commands, access sensitive files, or alter the web application's behavior. The scenario specifically mentions the use of 'SSI directives' and the ability to pass 'malicious SSI directives as input values' to modify server files.
Concept tested: Server-Side Includes (SSI) injection vulnerability
Source: https://owasp.org/www-community/attacks/Server-Side_Includes_(SSI)_Injection
Topics
Community Discussion
No community discussion yet for this question.