| name | severity | cvss-score | cvss-vector | cwe-id | cwe-name | compliance | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Server-side template injection |
high |
5.3 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
CWE-94 |
Improper Control of Generation of Code ('Code Injection') |
|
A server-side template injection vulnerability occurs when user input is placed in a server-side template. An attacker may be able to inject template directives with the objective of executing arbitrary code. The impact of this vulnerability depends on various factors, such as the template engine and what characters can be used in the payload. The most straightforward attacks give the attacker the ability to read information that it should not have access to. In some cases, this type of vulnerability may give the attacker full control over the server.
{% tabs server-side-template-injection %} {% tab server-side-template-injection generic %} The best recommendation is to avoid having templates depending on user input. Try to restrict any user input to template parameters and follow the template engine documentation on how to prevent injection vulnerabilities. {% endtab %}
{% endtabs %}