Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Server-Side Template Injection (SSTI) False Positive #8622

Open
1 task
tenaz3 opened this issue Sep 2, 2024 · 16 comments · May be fixed by zaproxy/zap-extensions#5802
Open
1 task

Server-Side Template Injection (SSTI) False Positive #8622

tenaz3 opened this issue Sep 2, 2024 · 16 comments · May be fixed by zaproxy/zap-extensions#5802
Assignees
@kingthorin
Labels
add-on FalsePositive

Comments

@tenaz3
Copy link

tenaz3 commented Sep 2, 2024 •
edited
Loading

Describe the bug

A Server-Side Template Injection (SSTI) vulnerability has been detected in the web application, but not the way I expected.

I ran on AttackStrength Default and HIGH, both got on this scenario.
This is happening on a variety of scan on different domains (+40)
How I can mitigate this False Positive?
Why does the scan looks only for the value 40034618 and not the entire zjprint40034618zj ?

Steps to reproduce the behavior

Go to the following URL: [https://XXX.com/wp-login.php?action=bpnoaccess&bp-auth=1&redirect_to=https%3A%2F%2FXXX.ocm%2Fmembers%2Fadmin-wa%2F&wp_lang=zj%7B%7Bprint+%222712%22+%223997%22%7D%7Dzj]

The response

<!DOCTYPE html>
<html lang="zjprint40034618zj">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>Web Academy - online platform</title>
<meta name="robots" content="max-image-preview:large, noindex, noarchive" />
</head>
</body>
</html>

Expected behavior

I expected this is not a vulnerability. I had quite a lot of a false positive where the lang has the value with the print in it.

Software versions

Current stable and dev versions was used for this.

Screenshots

No response

Errors from the zap.log file

No response

Additional context

Report:

Would you like to help fix this issue?

  • Yes
@tenaz3 tenaz3 added the bug label Sep 2, 2024
@thc202
Copy link
Member

thc202 commented Sep 3, 2024

Please, provide all the details of the alert.

@tenaz3
Copy link
Author

tenaz3 commented Sep 3, 2024

@thc202 I provided the context of the alert detection

@kingthorin
Copy link
Member

We are after the full details of the alert.

@tenaz3
Copy link
Author

tenaz3 commented Sep 4, 2024

@kingthorin OK, I added the full json report with request and response

@kingthorin
Copy link
Member

Thanks that helps.

@tenaz3
Copy link
Author

tenaz3 commented Sep 4, 2024

@kingthorin if you can delete the data and we share the information privately I appreciate.

@kingthorin
Copy link
Member

No problem. Removed. I can store in a limited access location.

@tenaz3
Copy link
Author

tenaz3 commented Sep 6, 2024 •
edited by kingthorin
Loading

@kingthorin did you have the chance to look on the issue?

@kingthorin
Copy link
Member

I think I might see an issue based on what you'd shared. I need to dig into the code.

@kingthorin kingthorin self-assigned this Sep 12, 2024
@tenaz3
Copy link
Author

tenaz3 commented Sep 24, 2024

@kingthorin Have you been able to identify the issue, or would you like more details?

@kingthorin
Copy link
Member

Thanks for checking in. Unfortunately due to an injury I haven't been able to dig into it yet.

@tenaz3
Copy link
Author

tenaz3 commented Sep 25, 2024

Oh, sorry to hear that, I hope you get better

@rbliss
Copy link

rbliss commented Sep 30, 2024 •
edited
Loading

Hey @kingthorin, sorry to hear about your injury. I hope you get feeling better soon! Also, congratulations on the Checkmarx move :)

I'm chiming in here with more data to help elucidate what I think is going on. With our clients, it appears that about 80% of the SSTI findings come from one particular check: the GoTemplateFormat.

The GoTemplateFormat checks for a concatenation of two numbers instead of a math operation like other template tests. It appears to generate FPs far more frequently due to how web apps tend to place input parameters into the page while filtering special characters. For example, here's the first 3 SSTI alerts I looked at from different sites:

Attack: zj{{print "6518" "7178"}}zj
Proof (from page): "is_analytics_enabled":"1","is_search":"1","is_id":"zjprint65187178zj","is_label":"","is_cat":"Results Found"}

Attack zj{{print "7996" "3057"}}zj
Proof (from page): <!DOCTYPE html> <html lang="zjprint79963057zj"> <head>

Attack zj{{print "2932" "1257"}}zj
Proof (from Location header): Location: https://example.com/web/index.php/component/search/?searchword=ZAP&ordering=newest&searchphrase=all&areas[0]=zjprint29321257zj&Itemid=224

The pattern is consistently that the attack parameter gets stripped of special characters and inserted into the page or URL. Since stripping the attack of special characters results in the concatenation of the two numbers, the test for concatenation doesn't differentiate between a correctly discovered evaluation of the attack parameter and an FP of the parameter getting cleaned and put back on the page without evaluation.

This definitely could be poor input parameter handling by the site, but I don't believe clears the threshold for SSTI.

I didn't dig into the history of the GoTemplateFormat to figure out why concatenation was used instead of multiplication like most of the others. Let me know if you want me to add the full software version info or help contribute in some way.

@kingthorin
Copy link
Member

Thanks that's great. The details are highly appreciated ‼️ @rbliss

@kingthorin kingthorin linked a pull request Oct 9, 2024 that will close this issue
Open
7 tasks
@kingthorin
Copy link
Member

Fix is inbound, PR opened.

@tenaz3 & @rbliss thank you for providing great details. That really makes our lives easier as far as getting things fixed.

@rbliss
Copy link

rbliss commented Oct 10, 2024

Took a look at the PR, looks great. Thanks a ton for all you do @kingthorin

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@kingthorin kingthorin

Labels
add-on FalsePositive
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

ascanrules: Address SSTI false positive kingthorin/zap-extensions
4 participants
@rbliss @tenaz3 @thc202 @kingthorin