CWE-97 Server-Side Include Injection

Coverage: 3 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 3 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged server-side include (SSI) directives being built from untrusted input. SSI features can include files or execute commands depending on server configuration.

Why it matters

SSI injection can read files or execute commands on the server.

• File disclosure (include arbitrary files).
• Command execution in unsafe configurations.
• Often appears when templates or legacy server features are used with user input.

Safer examples

1) Disable SSI where not needed

Turn off SSI processing in your server for user-controlled content.

2) Don't build include directives from user input

Use allowlists of known includes or server-side templates that don't interpret directives.

3) Treat includes as privileged

If includes are needed, ensure paths are fixed/allowlisted and not user-controlled (see CWE-23 / CWE-36).

How SiteShadow detects it (high level)

• Detects SSI directive patterns in server-rendered content.
• Flags cases where directive content is influenced by request/user input.

References

• CWE-97: https://cwe.mitre.org/data/definitions/97.html

---

← Back to Vulnerability Library