Code Execution via SSTI (ASP.NET Razor)
Severity:
Critical
Summary
Invicti identified a code execution which occurs when using an unintentional expression in template engine instead of string literals.
This is a highly critical issue and should be addressed as soon as possible.
Impact
An attacker can execute arbitrary code by using wrong construction in template engine tags. The attacker may also be able to execute arbitrary system commands.
Remediation
Do not trust the data that users supply and don't add it to directly into the template. Instead, pass user controlled parameters to the template as template parameters.
Required Skills for Successful Exploitation
Actions To Take
Vulnerability Index
You can search and find all vulnerabilities
Select Category
Select Vulnerability
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Build your resistance to threats. And save hundreds of hours each month.
