CWEweakness

CWE-97 Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

Official page ↗
Abstraction
Variant
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) directive.

Common consequences

• Confidentiality, Integrity, Availability: Execute Unauthorized Code or Commands

Detection methods

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Related

Attack pattern · CAPEC (2)

  • CAPEC-101 Server Side Include (SSI) Injection attack pattern
  • CAPEC-35 Leverage Executable Code in Non-Executable Files attack pattern

Child of · CWE (1)

  • CWE-96 Improper Neutralization of Directives in Statically Saved Code weakness

Referenced by CAPEC · weakness (2)

  • CAPEC-101 Server Side Include (SSI) Injection attack pattern
  • CAPEC-35 Leverage Executable Code in Non-Executable Files attack pattern

Referenced by CVE · weakness (7)

  • CVE-2023-53934 A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the… vulnerability
  • CVE-2025-35996 KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename that can be stored… vulnerability
  • CVE-2025-36558 KUNBUS PiCtory version 2.11.1 and earlier are vulnerable to a cross-site-scripting attack via the sso_token used for authentication. vulnerability
  • CVE-2025-21103 Dell NetWorker Management Console, version(s) 19.11 through 19.11.0.3 & Versions prior to 19.10.0.7 contain(s) an improper neutralization… vulnerability
  • CVE-2024-56363 APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed for penetration… vulnerability
  • CVE-2024-37621 StrongShop v1.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the component… vulnerability
  • CVE-2024-29686 Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted… vulnerability

Referenced by OWASP · mapped cwe (2)