CWE - CWE-97: Failure to Sanitize Server-Side Includes (SSI) Within a Web Page (1.1)

Home > CWE List > CWE- Individual Dictionary Definition (1.1)

CWE List
Full Dictionary View
Development View
Research View
Reports

About
Sources
Process
Documents

Community
Related Activities
Discussion List
Research
CWSS

News
Calendar
Free Newsletter

Compatibility
Program
Requirements
Declarations
Make a Declaration

Contact Us
Search the Site

CWE-97: Failure to Sanitize Server-Side Includes (SSI) Within a Web Page

Individual Definition in a New Window

Failure to Sanitize Server-Side Includes (SSI) Within a Web Page

Status: Draft

Weakness ID: 97 (Weakness Base)

Description

Summary

The software fails to adequately filter server-side include (control-plane) syntax from user-controlled input (data plane) and then allows potentially injected server-side includes to be acted upon.

Potential Mitigations

Implementation

Utilize an appropriate mix of white-list and black-list parsing to filter server-side include syntax from all input.

Other Notes

This can be resultant from XSS/HTML injection because the same special characters can be involved. However, this is server-side code execution, not client-side.

Relationships

Nature	Type	ID	Name	View(s) this relationship pertains to
ChildOf	Weakness Base	96	Insufficient Control of Directives in Statically Saved Code (Static Code Injection)	Development Concepts (primary)699 Research Concepts (primary)1000

Taxonomy Mappings

Mapped Taxonomy Name	Mapped Node Name
PLOVER	Server-Side Includes (SSI) Injection

Applicable Platforms

Languages

All

Time of Introduction

Architecture and Design

Implementation

Related Attack Patterns

CAPEC-ID	(CAPEC Version 1.1)Attack Pattern Name
35	Leverage Executable Code in Nonexecutable Files
101	Server Side Include (SSI) Injection

Content History

Submissions

PLOVER. (Externally Mined)

Modifications

Eric Dalci. Cigital. 2008-07-01. (External)

updated Time_of_Introduction

CWE Content Team. MITRE. 2008-09-08. (Internal)

updated Relationships, Other_Notes, Taxonomy_Mappings

Previous Entry Names

Server-Side Includes (SSI) Injection (changed 2008-04-11)

Page Last Updated: November 24, 2008


	CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security. This Web site is hosted by The MITRE Corporation. Copyright 2008, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation. Contact cwe@mitre.org for more information.	Privacy policy Terms of use Contact us