/

/

SSTI in Freemarker

SSTI in Freemarker

Fuzzing vulnerable payloads in request body and query params to assess Server-Side Template Injection vulnerability.

Server Side Template Injection (SSTI)

"By fuzzing vulnerable payloads in request bodies and query parameters, it aims to identify and exploit Server-Side Template Injection vulnerabilities specific to FreeMarker templates. This test assesses the risk of arbitrary code execution, data exposure, and server compromise within the FreeMarker templating engine, ensuring comprehensive security assessment."

"By fuzzing vulnerable payloads in request bodies and query parameters, it aims to identify and exploit Server-Side Template Injection vulnerabilities specific to FreeMarker templates. This test assesses the risk of arbitrary code execution, data exposure, and server compromise within the FreeMarker templating engine, ensuring comprehensive security assessment."

Impact of the vulnerability

Impact of the vulnerability

Server-Side Template Injection (SSTI) allows attackers to execute arbitrary code on a server, leading to data exposure, remote code execution, and potential server compromise, posing severe security and privacy risks.

Server-Side Template Injection (SSTI) allows attackers to execute arbitrary code on a server, leading to data exposure, remote code execution, and potential server compromise, posing severe security and privacy risks.

How this template works

APIs Selection

The template uses regular expressions to match any request payload or query parameter key. It then extracts the matched key and assigns it to either "payloadKey" or "queryKey" for further use.

Execute request

The template modifies the query parameter "queryKey" by injecting the value "%24%7B89%20*%2091%7D", which represents the expression "${89*91}". Similarly, it modifies the request body parameter "payloadKey" by injecting the expression "${89*91}". These modifications aim to test for Server-Side Template Injection vulnerabilities.

Validation

The template validates the response payload by checking if it contains either the string "8099". This ensures that the executed request has successfully triggered the expected behavior related to Server-Side Template Injection.

Frequently asked questions

What is Server-Side Template Injection (SSTI) and how does it pose a security risk in the context of FreeMarker templates

What is Server-Side Template Injection (SSTI) and how does it pose a security risk in the context of FreeMarker templates

What is Server-Side Template Injection (SSTI) and how does it pose a security risk in the context of FreeMarker templates

How does the SSTI_IN_FREEMARKER test identify and exploit Server-Side Template Injection vulnerabilities specific to FreeMarker templates

How does the SSTI_IN_FREEMARKER test identify and exploit Server-Side Template Injection vulnerabilities specific to FreeMarker templates

How does the SSTI_IN_FREEMARKER test identify and exploit Server-Side Template Injection vulnerabilities specific to FreeMarker templates

What are the potential impacts of a successful Server-Side Template Injection attack, including the risks of arbitrary code execution, data exposure, and server compromise

What are the potential impacts of a successful Server-Side Template Injection attack, including the risks of arbitrary code execution, data exposure, and server compromise

What are the potential impacts of a successful Server-Side Template Injection attack, including the risks of arbitrary code execution, data exposure, and server compromise

How does the test modify the request payload and query parameters to fuzz vulnerable payloads and assess the presence of SSTI vulnerabilities

How does the test modify the request payload and query parameters to fuzz vulnerable payloads and assess the presence of SSTI vulnerabilities

How does the test modify the request payload and query parameters to fuzz vulnerable payloads and assess the presence of SSTI vulnerabilities

What are the specific selection filters used in the test to identify relevant request payloads and query parameters for fuzzing

What are the specific selection filters used in the test to identify relevant request payloads and query parameters for fuzzing

What are the specific selection filters used in the test to identify relevant request payloads and query parameters for fuzzing

How does the test validate the response payload to determine if the SSTI vulnerability has been successfully exploited, specifically looking for the presence of the value '8099'

How does the test validate the response payload to determine if the SSTI vulnerability has been successfully exploited, specifically looking for the presence of the value '8099'

How does the test validate the response payload to determine if the SSTI vulnerability has been successfully exploited, specifically looking for the presence of the value '8099'

Loved by security teams!

Loved by security teams!

Product Hunt Badge

"We are absolutely thrilled with the testing feature of Akto. We have used it on our graphQL endpoints and it performs flawlessly identifying common API security issues. It's truly a game-changer and we highly recommend Akto to anyone looking to effortlessly secure their API endpoints. With a user-friendly interface, it's the perfect solution for anyone looking to embrace custom rules with context to reduce false positives."

Loom Company logo

Security team,

Loom

"We are absolutely thrilled with the testing feature of Akto. We have used it on our graphQL endpoints and it performs flawlessly identifying common API security issues. It's truly a game-changer and we highly recommend Akto to anyone looking to effortlessly secure their API endpoints. With a user-friendly interface, it's the perfect solution for anyone looking to embrace custom rules with context to reduce false positives."

Loom Company logo

Security team,

Loom

"We are absolutely thrilled with the testing feature of Akto. We have used it on our graphQL endpoints and it performs flawlessly identifying common API security issues. It's truly a game-changer and we highly recommend Akto to anyone looking to effortlessly secure their API endpoints. With a user-friendly interface, it's the perfect solution for anyone looking to embrace custom rules with context to reduce false positives."

Loom Company logo

Security team,

Loom

"The text editor in Akto is absolutely remarkable. Its user-friendly YAML format strikes the perfect balance between simplicity and power. With intuitive features like 'API selection filter', 'Execute', Validate' creating test rules becomes incredibly easy. Akto's test editor is a game-changer, enabling seamless creation of highly personalized and effective tests that could meet the needs of any modern day organization. "

Rippling Company logo

Security team,

Rippling

"The text editor in Akto is absolutely remarkable. Its user-friendly YAML format strikes the perfect balance between simplicity and power. With intuitive features like 'API selection filter', 'Execute', Validate' creating test rules becomes incredibly easy. Akto's test editor is a game-changer, enabling seamless creation of highly personalized and effective tests that could meet the needs of any modern day organization. "

Rippling Company logo

Security team,

Rippling

"The text editor in Akto is absolutely remarkable. Its user-friendly YAML format strikes the perfect balance between simplicity and power. With intuitive features like 'API selection filter', 'Execute', Validate' creating test rules becomes incredibly easy. Akto's test editor is a game-changer, enabling seamless creation of highly personalized and effective tests that could meet the needs of any modern day organization. "

Rippling Company logo

Security team,

Rippling

Suggest API security tests

Suggest API security tests

We're actively building the test library. Suggest a test! If we like your suggestion, you will see it in the library in few days.

We're actively building the test library. Suggest a test! If we like your suggestion, you will see it in the library in few days.