Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upPython : Add query to detect Server Side Template Injection #93
Comments
|
Hi @porcupineyhairs, I'm working on generating a TP result set based on your PR. I am so far unable to generate a TP result even with e.g. the PoC app mentioned from issue #6 in your CVE section (which is a PoC app). Would you be able to provide a ql db for a vulnerable project that your query generates a TP result against? |
|
Status update. The query run failed due to 2 small underlying issues which are now fixed. A rerun of the query against LGTM databases resulted in 20 detections in 13 independent projects. All of which are true positives. I am in the process of reporting them. I will open a separate issue in the Bug Slayer category if these result in 4 CVE's. |
|
Created Hackerone report 944359 for bounty 235114 : [93] Python : Add query to detect Server Side Template Injection |
CVE
This is a very common issue. Multiple blogs and hackerone reports cover this. I am including a few of them here.
Report
This query detects instances where user input is embedded in a template in an unsafe manner.
The PR adds support for multiple Python templating engines. As of now it covers
The PR also includes tests along with well documented code.
Link to the PR:[github/codeql#3396]
--- Edit history:
25 June : updated the list of template engines and added a few references in the
cvesection.