us-15-Kettle-Server-Side-Template-Injection-RCE-For-The-Modern-Web-App-wp外文文献.pdfVIP

Server-Side Template Injection: RCE for the modern webapp James Kettle - james.kettle@ - @albinowax Abstract Template engines are widely used by web applications to present dynamic data via web pages and emails. Unsafely embedding user input in templates enables Server-Side Template Injection , a frequently critical vulnerability that is extremely easy to mistake for Cross-Site Scripting (XSS), or miss entirely . Unlike XSS, Template Injection can be used to directly attack web servers internals and often obtain Remote Code Execution (RCE), turning