A script language injection or script injection is a flaw mostly present in the web.
\nA script language injection is when a programming language uses user input to execute code without filtering it.
\nThis vulnerability is similar to OS command injection, but differs in the way it is executed.<\/p>\n","protected":false},"excerpt":{"rendered":"
Discover our solution and its features.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1033","post","type-post","status-publish","format-standard","hentry","category-posts"],"acf":{"headings":[{"acf_fc_layout":"base","title_category_icon":766,"title_category":"Post","title_category_color":"clr-pink","title":"How to effectively protect against script injection<\/span> attacks?","title_color":"clr-white","title_description":"","title_description_theme":"content-text-dark","title_buttons":null,"background":"bg-gradient-purple-blue-bl","padding_top":"pt-xxlarge","padding_bottom":"pb-xxlarge","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":true,"separator_bottom_color":"sep-white","opt_breadcrumb":true,"opt_breadcrumb_theme":"breadcrumb-dark"}],"background_image":null,"modules":[{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"Let's look at a command injection scheme:","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-large","padding_bottom":"pb-xlarge","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-center","images":[1254],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"split","mod_eyebrow":"","mod_eyebrow_color":"clr-purple","mod_title":"","mod_title_color":"clr-purple","mod_title_alignment":"align-left","mod_wysiwyg":"","mod_wysiwyg_theme":"content-text-light","mod_col_left":[{"acf_fc_layout":"mod_item_text","mod_item_text_el":"In this example, the server will execute a command on the operating system that hosts it, so it is commands specific to the different shells that can be injected.\r\nLet's look at the script injection:","item_options":{"item_option_paragraph_theme":"content-text-light"}}],"mod_col_right":[{"acf_fc_layout":"mod_item_image","mod_item_image_el":1255}],"columns_theme":"col-transparent","background_image":"","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","left_valign":"force-v-align-top","right_valign":"force-v-align-top","unique_id":""},{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"Here, the server itself executes a command specific to the language it uses.\r\nAn attacker must then use language-specific functions.\r\nHowever, most languages used on a server can interact with the operating system, so the risks are similar to OS command injection\r\nHowever, where command injection is only located on the server side, a script injection can also be performed on the client side if the javascript used allows it.\r\n\r\nImpact<\/h2>\r\nScript injections have the impacts of 3 vulnerabilities:\r\n\r\n
OS Command Injection<\/h3>\r\nScript injections allow for command injections with functions such as system() that execute a command on the OS See article on command injections<\/a>. SQL injection If the victim server uses a database, then it is possible to perform SQL injections and have the same risks as the latter. (See article on SQL injections<\/a>). Cross Site Scripting (XSS) When a script injection vulnerability is located on the client side, the application then becomes vulnerable to reflected XSS {reflected XSS}, the consequences can be multiple. See article on script injection<\/a>s. \r\n\r\n
How can a hacker inject code? <\/h2>\r\n\r\n
1. A vulnerable client side and server side<\/h3>\r\n\r\nTo illustrate a script injection attack, I will use the example of a web application containing 2 vulnerabilities: one located on the client side and one located on the server side. It is advisable to have followed the articles on command injections and Cross Site Scripting in order to understand what a command injection is and how a thoughtful XSS works. The vulnerable site allows you to practice equations, a \"generate\" button displays a random equation and a form to complete it.","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-left","images":[1251],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"
2. Exploiting server-side script injection<\/h3>\r\n\r\nOn the form, Loris will attempt to enter a Shell command.","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-center","images":[1252],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"He ends up with a PHP error message.\r\nHe then understands that his input is being processed by the eval function, a function for executing PHP code in a PHP program.\r\nIn order to be able to execute Shell commands, he will then transform his input into :","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-center","images":[1253],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"The system function will allow any Shell command to be executed, so the malicious code executed by the server will look like this:","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-center","images":[1260],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"When doing an ls, Loris sees a file called \"routes.txt\",","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-center","images":[1261],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"Using cat on it, Loris ends up with all the routes available on the website, including \"\/{endpoint_name}\" which is not visible on the web page.","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-center","images":[1256],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"
3. Exploiting client-side script injection<\/h3>\r\nGoing to it, Loris then finds a classic page:","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-center","images":[1257],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"Looking in the HTML code, he notices a section <script> calling the eval function, working similarly to the eval function in PHP but with Javascript code. This function seems to use a parameter of the url.","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-center","images":[1258],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"It is therefore possible to make a browser execute javascript code thanks to a parameter in the url\r\nUsing malicious code to redirect an administrator's cookies to his server with 'document.cookie', Loris would then have access to an account with elevated privileges.\r\nSo all he has to do is build his code for a thoughtful XSS:\r\nThen place it in the 'value' parameter of the url.\r\nFinally, using a bit of social engineering, he just has to send an email to a site administrator to make him click on the link containing the attack to execute the javascript.\r\n\r\n
What are the protections against script injection attacks? <\/h2>\r\n\r\nTo protect against script injection attacks the recommendations for other injections apply:\r\n
\r\n\t
How to protect yourself from script injection attacks with UBIKA Cloud protector<\/h2>\r\n \r\nUBIKA Cloud Protector allows to protect web applications thanks to its syntax engine which allows it to detect the grammar of the different languages used on the server side: PHP, Java etc.","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"photos","title":"","mod_title_color":"clr-white","mod_title_alignment":"align-center","images":[1259],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"wysiwyg","mod_wysiwyg":"In this example, UBIKA Cloud Protector will detect 2 malicious patterns:
![\"\"](\"https:\/\/www-dev.ubikasec.com\/wp-content\/uploads\/2023\/04\/Article_injectionScript_If_code.png\")
, and assign them a score.\r\nIf the total score is above the allowed limit, the request will be intercepted and the user will be redirected to a blocking page.","mod_wysiwyg_theme":"content-text-light","background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","unique_id":""},{"acf_fc_layout":"buttons","button":[{"internal_link":75,"external_link":"","button_style":"cta-turquoise-white","button_label":"Request a 14-day free trial"}],"background":"bg-solid-white","padding_top":"pt-medium","padding_bottom":"pb-medium","decoration":"deco-none","separator_top":false,"separator_top_color":"sep-white","separator_bottom":false,"separator_bottom_color":"sep-white","button_align":"align-center","unique_id":""}],"dl_form":"","dl_form_title":"","dl_gated":false,"dl_asset":""},"yoast_head":"\n