Scribd
Upload
3 views5 pages

Understanding Server-Side JS Injection

Uploaded by

s
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
3 views5 pages

Understanding Server-Side JS Injection

Uploaded by

s
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

Server-side JavaScript

Injection(SSJI)
Server Side JavaScript injection is the ability for a user to inject code which will in
turn be evaluated by the server, and therefore would allow an attacker to
potentially execute arbitrary code under the context of the server and interaction
with the filesystem, which may lead to the full compromise of the host.
Some JS functions can be exploited by an attacker to execute malicious JS code
on the server:

eval()

setTimeout()

setInterval()

Function()

Inadequate input validation

Direct execution of user provided code

Using dangerous function


Using new Function() in JS

Insecure deserialization
There is some JSON data that is coming and we do deserialization without
checking

Server-side JavaScript Injection(SSJI) 1


Server-side JavaScript Injection(SSJI) 2
Server-side JavaScript Injection(SSJI) 3
Any issue in setTimeout/setInterval can lead to global exceptions. If global
exceptions are not handled properly, it can do lot of damage.

Server-side JavaScript Injection(SSJI) 4


Server-side JavaScript Injection(SSJI) 5

You might also like