Menu Icon

Cobalt Vulnerability Wiki

Cobalt Vulnerability Wiki

Categories

Toggle Arrow IconV2 - AuthenticationToggle Arrow IconV3 - Session ManagementToggle Arrow IconV4 - Access ControlToggle Arrow IconV5 - Validation/Sanitization
Blind SQL injectionClickjackingCommand Injection Cookie-Based XSS Cross Site Script Inclusion (XSSI)CSRF/URL-Based XSS CSS injectionCSV Injection DOM-Based XSSFlash-Based XSS HTML injection HTTP Parameter Pollution to XSS HTTP Request Smuggling HTTP Response Splitting (CRLF)iframe InjectionLDAP injection Local File InclusionOOB (Out of Band) XXEOpen Redirect Reflected File Download (RFD) Reflected Self-XSSReflected XSS Reflected XSS - WAF bypassRemote Code ExecutionRemote File InclusionRosetta FlashServer Side Template InjectionServer Side Template Injection (SSTI) in Flask SQL Injection SSI InjectionSSRF Stored XSSTabnabbing TRACE Method XSS - Cross-Site Tracing (XST) Universal (UXSS) XSS WAF Bypass XSS via RefererXXE
Toggle Arrow IconV6 - CryptographyToggle Arrow IconV7 - Error LoggingToggle Arrow IconV8 - Data ProtectionToggle Arrow IconV9 - CommunicationsToggle Arrow IconV10 - Malicious CodeToggle Arrow IconV11 - Business LogicToggle Arrow IconV12 - Files ResourcesToggle Arrow IconV13 - APIToggle Arrow IconV14 - Config
Arrow Left

V5 - Validation/Sanitization

Server Side Template Injection

POC

To identify SSTI vulnerabilities, it’s recommended to use a Polyglot payload composed of special characters commonly used in template expressions to fuzz the template.



${{<%[%'"}}%\.



In case of a vulnerability, an error message can be returned or the exception can be raised by the server. This can be used to identify the vulnerability and the template engine in use.



In general, to identify the vulnerability, the following to-do list can be followed:


- Detect where the template injection exist


- Identify the template engine and validate the vulnerability


- Follow the manuals for the specific template engine


- Exploit the vulnerability



Try known syntaxes to see the mathematical operation result as 21


=${7*3}


={{7*3}}


=<%= 7*3 %>



Note: This is a broad concept, above payload is just an example




Impact

Low-Medium-High (depends on the attack)



Likelihood

Low-Medium-High (depends on the attack)


Ready to get started?

our platformschedule a demo
Aircall logoAlgolia logoCangageCredit KarmaDattoEgnyteHubspotMovinimageMulesoftPendoSentaraSmarshSnowSolarisTalkdeskVerifoneKubraAxel SpringerNuna

Join some of these great clients we're proud to have helped