CTF 6 revealed (wizer-ctf.com/...) and the main key takeaway from our secure coding journey is: READ THE FREAKING MANUAL!!!! Seriously, whenever you're using a library for any task, take the time to read the manual and understand what kinds of risks could arise from utilizing its various options, especially when user input is involved. In this particular case, the ability to change the library options using user input slipped through the cracks.
More takeways:
👉 Avoid creation of template strings from user input:
Always preset templates on the server and feed arguments under strict control and sanitization of user inputs. Some apps may require more flexibility, so if there's absolutely no way around it, the user-input template should be strictly sanitized and we need to make sure that the user doesn't have control over any extended or more powerful than intended options. Always remember that a template engine might have such loopholes or powerful intended behaviors by the nature of its designed purpose.
👉 Attackers don't necessarily need access to the code to identify SSTI vulns:
Experienced attackers can fairly easily map code which is using a template engine. Then based on the type of template engine, they already have the risks mapped and could effectively exploit them.
Wizer Free Security Awareness Training (wizer-training...) includes everything you need to train your employees how to protect themselves against cyber attacks. Yes, our basic plan is 100% free forever with free videos, quizzes, employee progress reports, and much more. Additional compliance training such as HIPAA, GDPR and Phishing simulation and Phishing Gamification are offered in our paid Boost version.
Get started here: www.wizer-trai...
Follow us and join in the conversations!
LinkedIn: / wizer-1-minute-security
Twitter: / wizertraining
Facebook: / staywizer
Негізгі бет Secure Coding Training for Developers - Server Side Template Injection
Пікірлер