Websites Vulnerable to SSTI is a set of simple servers which are vulnerable to Server Side Template Injection.
It is not available online, the GitHub repo is https://github.com/DiogoMRSilva/websitesVulnerableToSSTI It is actively maintained by a ZAP contributor: Diogo Silva.
The vulnerabilities are reported by various ZAP scan rules - if any of them find a vulnerability then we count that as a pass.
Note that the “Non Vulnerable” site is actually vulnerable to XSS attacks 😄
| Section | Score | ||||||
|---|---|---|---|---|---|---|---|
All URLs |
95% |
||||||
| Individual Tests | Reflected XSS | DOM XSS | Expr Lang Inj | Server Code Inj | SSTI | SSTI Blind | Result |
| Jinja2 - Python | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ✓ Pass | ❌ Fail | ✓ Pass |
| Mako - Python | ✓ Pass | ✓ Pass | ✓ Pass | ❌ Fail | ✓ Pass | ✓ Pass | ✓ Pass |
| (Code eval) - Python | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ✓ Pass | ✓ Pass | ✓ Pass |
| (Code exec) - Python | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ❌ Fail | ✓ Pass | ✓ Pass |
| Smarty - PHP | ✓ Pass | ✓ Pass | ✓ Pass | ❌ Fail | ✓ Pass | ✓ Pass | ✓ Pass |
| Smarty (secure mode) - PHP | ✓ Pass | ✓ Pass | ✓ Pass | ❌ Fail | ✓ Pass | ❌ Fail | ✓ Pass |
| Twig - PHP | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ✓ Pass | ❌ Fail | ✓ Pass |
| (Code eval) - PHP | ❌ Fail | ❌ Fail | ❌ Fail | ✓ Pass | ❌ Fail | ❌ Fail | ✓ Pass |
| FreeMarker - Java | ❌ Fail | ✓ Pass | ❌ Fail | ❌ Fail | ❌ Fail | ❌ Fail | ✓ Pass |
| Velocity - Java | ❌ Fail | ✓ Pass | ❌ Fail | ❌ Fail | ❌ Fail | ❌ Fail | ✓ Pass |
| Thymeleaf - Java | ❌ Fail | ✓ Pass | ❌ Fail | ❌ Fail | ❌ Fail | ❌ Fail | ✓ Pass |
| Jade - Nodejs | ✓ Pass | ❌ Fail | ❌ Fail | ❌ Fail | ✓ Pass | ✓ Pass | ✓ Pass |
| Nunjucks - JavaScript | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ✓ Pass | ✓ Pass | ✓ Pass |
| doT - JavaScript | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ✓ Pass | ✓ Pass | ✓ Pass |
| Dust - JavaScript | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ✓ Pass | ❌ Fail | ✓ Pass |
| EJS - JavaScript | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ✓ Pass | ✓ Pass | ✓ Pass |
| (Code eval) - JavaScript | ❌ Fail | ❌ Fail | ❌ Fail | ❌ Fail | ❌ Fail | ❌ Fail | ❌ Fail |
| VueJs - JavaScript | ❌ Fail | ✓ Pass | ❌ Fail | ❌ Fail | ✓ Pass | ❌ Fail | ✓ Pass |
| Slim - Ruby | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ✓ Pass | ✓ Pass | ✓ Pass |
| ERB - Ruby | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ✓ Pass | ✓ Pass | ✓ Pass |
| (Code eval) - Ruby | ❌ Fail | ✓ Pass | ❌ Fail | ❌ Fail | ❌ Fail | ❌ Fail | ✓ Pass |
| go - go | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ✓ Pass | ❌ Fail | ✓ Pass |
| Input rendered in other location | ❌ Fail | 57% ↓ | ❌ Fail | ❌ Fail | ❌ Fail | ❌ Fail | 57% ↓ |
| Rendering result not visible to attacker | ❌ Fail | ❌ Fail | ❌ Fail | ❌ Fail | ❌ Fail | ✓ Pass | ✓ Pass |
| Input inserted in the middle of template code math operations | ❌ Fail | ❌ Fail | ❌ Fail | ❌ Fail | ❌ Fail | ✓ Pass | ✓ Pass |
| Non Vulnerable | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ❌ Fail | ❌ Fail | ✓ Pass |
| Input inserted in the middle of template code text | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ❌ Fail | ❌ Fail | ✓ Pass |
| { } Python Eval | ✓ Pass | ✓ Pass | ✓ Pass | ❌ Fail | ✓ Pass | ✓ Pass | ✓ Pass |
| ${ } Python Eval | ✓ Pass | ✓ Pass | ✓ Pass | ❌ Fail | ✓ Pass | ✓ Pass | ✓ Pass |
| {{ }} Python Eval | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ✓ Pass | ✓ Pass | ✓ Pass |
| <%= %> Python Eval ERB | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ✓ Pass | ❌ Fail | ✓ Pass |
| #{ } Python Eval | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ✓ Pass | ❌ Fail | ✓ Pass |
| {{= }} Python Eval | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ✓ Pass | ❌ Fail | ✓ Pass |
| { } Ruby Eval | ✓ Pass | ✓ Pass | ✓ Pass | ❌ Fail | ✓ Pass | ✓ Pass | ✓ Pass |
| ${ } Ruby Eval | ✓ Pass | ✓ Pass | ✓ Pass | ❌ Fail | ✓ Pass | ❌ Fail | ✓ Pass |
| {{ }} Ruby Eval YBNE Nunjucks | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ✓ Pass | ❌ Fail | ✓ Pass |
| <%= %> Ruby Eval Erb | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ✓ Pass | ✓ Pass | ✓ Pass |
| #{ } Ruby Eval | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ✓ Pass | ✓ Pass | ✓ Pass |
| {{= }} Ruby Eval | ✓ Pass | ✓ Pass | ❌ Fail | ❌ Fail | ✓ Pass | ❌ Fail | ✓ Pass |
Total Passes |
29 |
33 |
7 |
1 |
27 |
18 |
37 |
Configuration
| Config | Details |
|---|---|
| Frequency | Daily |
| Scripts | https://github.com/zapbot/zap-mgmt-scripts/blob/master/scans/ssti/ |
| Action | https://github.com/zapbot/zap-mgmt-scripts/actions/workflows/zap-vs-ssti.yml |
Settings
The latest Nightly ZAP Docker image is run with the default settings against this app with no exceptions.