Summary

Netsparker identified a code execution which occurs when using an unintentional expression in template engine instead of string literals.

Even though Netsparker believes there is a code execution in here, it could not confirm it. There can be numerous reasons for Netsparker not being able to confirm it. We strongly recommend you investigate the issue manually to ensure it is a remote code execution and needs to be addressed.

Impact
An attacker can execute arbitrary code by using wrong construction in template engine tags. The attacker may also be able to execute arbitrary system commands.
Remediation
Do not trust the data that users supply and don't add it to directly into the template. Instead, pass user params to the template engine as template parameters.
Required Skills for Successful Exploitation
This vulnerability is not difficult to leverage. There are vast resources available for template engines. Successful exploitation requires knowledge of the programming language and syntax of template engine. Minimal attack skill is enough to exploit vulnerabilities like this one.
Classifications
PCI v3.1-6.5.1, PCI v3.2-6.5.1, CAPEC-23, OWASP 2013-A1 , CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vulnerability Index

Vulnerability Index

You can search and find all vulnerabilities

Select Category

OR

Search Vulnerability

;
Netsparker

Dead accurate, fast & easy-to-use Web Application Security Scanner

GET A DEMO