GGSec Cortex Report — template_engine.php

Security Assessment Report

GG Advanced IT Security · ggsec.de

SAST 0.1s DAST 12.5s 7 requests 1 confirmed vulns 2 likely 4 SAST targets GGSec Cortex v0.9 Beta

F

Security
Rating

Executive Summary

GGSec Cortex identified 1 confirmed and 2 likely vulnerabilities in template_engine.php. Every confirmed finding is evidence-backed — proven by a live proof-of-concept or a baseline-difference control (a forged/malicious request is accepted while a matched control is rejected), so false positives are minimised. Likely findings are confirmed marker-leak / parser-differential signals without a full request-hijack proof — they warrant manual verification, not an emergency response. Immediate remediation is recommended.

💰

Business Impact

Full server compromise (remote code execution)

🧰

Exploitation Complexity

Low — reachable by a remote attacker

🎯

Likelihood

High — confirmed findings have a live proof-of-concept

⚠

Overall Risk

Critical · max CVSS 8.8

Assessment Scope

📄

Target

template_engine.php

🌐

Base URL

http://172.26.203.184

🔗

Endpoints tested

2

📤

Total requests

7

⚙

HTTP methods

GET, POST

🛡

Vulnerability classes

3

🔑

Authentication

Unauthenticated

🔎

SAST duration

0.1s

⚡

DAST duration

12.5s

📅

Scan completed

2026-07-10 20:32

Scan Timeline

20:32:43

Scan started

20:32:43

SAST replay (cached plan)

20:32:43

DAST probing started

20:32:47

GGC-NOSQL-089 confirmed — NOSQL_INJECTION filter

20:32:55

DAST probing completed (12.5s, 7 requests)

20:32:56

Report generated

Overview

⚠

1

Confirmed Vulns

❔

2

Likely (review)

💀

2

Critical SAST

🔥

2

High SAST

💻

0

RCE

🗃

1

SQLi

⚡

0

XSS

🌐

0

SSRF

📄

0

XXE

🎭

0

CSRF

📡

0

JSONP

🔓

0

Auth Bypass

📤

7

Total Requests

Confirmed vulns by sink type DAST

NOSQL_INJECTION1

SAST impact distribution SAST

RCE

3

DOS

1

DAST hit rate by sink DAST

NOSQL_INJECTION

3/3

OUTDATED_COMPONENT

2/2

SSTI

0/2

Risk Matrix

Likelihood ▼ / Impact ▶	Negligible	Minor	Moderate	Major	Severe
Almost certain
Likely
Possible				1
Unlikely
Rare

Remediation Plan

ID	Finding	CVSS	Priority	SLA
GGC-NOSQL-089	🔍 NOSQL_INJECTION filter	8.8	P1	Within 7 days

Compliance Coverage

Each finding mapped to OWASP Top 10 2021, PCI-DSS v4.0, ISO/IEC 27001:2022 and GDPR. References are indicative for audit scoping, not a certification statement.

OWASP Top 10 (2021)	# Findings	PCI-DSS v4.0	ISO/IEC 27001:2022	GDPR
A03:2021 – Injection	2	PCI-DSS v4.0 Req 6.2.4 (injection/XSS)	ISO/IEC 27001:2022 A.8.28	GDPR Art. 32 (security of processing)
A06:2021 – Vulnerable and Outdated Components	2	PCI-DSS v4.0 Req 6.3.1 / 6.3.3 (patch mgmt)	ISO/IEC 27001:2022 A.8.8	GDPR Art. 32 (security of processing)

SAST — Attack Surface

SAST confidence = static taint-flow certainty (source→sink), not runtime proof. "Confirmed" is reserved for DAST findings the engine actually exploited.

#	Parameter	Sink	Risk	CVSS	Static confidence	Exploit.	Impact	Location
1	`body`	🔍 SSTI	Critical	9.8 CRITICAL	Taint-flow	Chained	RCE	POST /save (JSON body field 'body') → GET ?action=admin_render (rendered output)
2	`filter`	🔍 NOSQL_INJECTION	High	9.8 CRITICAL	High	Direct	RCE	POST /save (JSON body field 'filter')
3	`apache 2.4.58 · CVE-2024-38475`	🔍 OUTDATED_COMPONENT	Critical	9.8 CRITICAL	Taint-flow	Direct	RCE	HTTP Server / X-Powered-By banner
4	`apache 2.4.58 · CVE-2024-38476`	🔍 OUTDATED_COMPONENT	High	7.5 HIGH	Taint-flow	Direct	DOS	HTTP Server / X-Powered-By banner

Endpoint Summary

Endpoint	Requests	Findings	Risk
http://172.26.203.184/template_engine.php/save	3	🔍 NOSQL_INJECTION	CRITICAL
template_engine.php	4	🔍 OUTDATED_COMPONENT	CRITICAL

DAST — Vulnerability Details

Confirmed only

🔍 GGC-SSTI-796 7.4 HIGH Potential SSTI body POST /save (JSON body field 'body') → GET ?action=admin_render (rendered output) 0/2 hits ▼

Flow

User-supplied 'body' field from the JSON POST to /save is written to /tmp/ggsec_templates/user_1.txt without any sanitization. When GET ?action=admin_render is requested, the file content is read back and passed through preg_replace_callback matching /\{\{(.*?)\}\}/ which feeds the captured expression into eval('return ' . $m[1] . ';'). Any PHP expression inside {{…}} is executed server-side. This is a second-order SSTI: injection is stored at one endpoint and triggered at another.

Attack Chain

1. GET ?action=login to obtain a session. 2. POST /save with JSON body containing a malicious 'body' field (e.g. ggsec{{7*7}} or {{system('id')}}). 3. GET ?action=admin_render to trigger eval on the stored template. The rendered_output field contains the evaluated result.

Impact

RCE — Chained

CWE / CVSS

CWE-1336 Server-Side Template Injection · CVSS 7.4 High (Base 9.8 Critical)

Untrusted input reaches a server-side template engine, executing template expressions and often OS commands.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RC:U

ⓘ Base 9,8 → Effective 7,4 — auth-gated (PR:L), potential (E:U/RC:U).

Compliance Impact

A03:2021 – Injection

PCI-DSS v4.0 Req 6.2.4 (injection/XSS) · ISO/IEC 27001:2022 A.8.28 · GDPR Art. 32 (security of processing)

MITRE ATT&CK

T1190 Exploit Public-Facing Application · T1059 Command and Scripting Interpreter

Initial Access, Execution

Certainty / Access

Potential · 👤 Customer

Remediation

Never build templates from user input — pass user data as bound variables to a sandboxed engine.

Keep templates static; render user data through the engine's context/variables, never concatenate it into the template source.
Enable the engine's sandbox/auto-escape (e.g. Jinja2 SandboxedEnvironment, Twig sandbox) and disable dangerous tags/functions.
Validate/allowlist any value that must influence template selection.

Refs: CWE-1336 · OWASP: Server-Side Template Injection

Result Method URL Payload Status Time Detection DB

✓ OK

GET (2nd-order)

template_engine.php?action=admin_render

RENDER:seed=ggsec{{7*7}}|store=/save|storefield=body|render=/?action=admin_render|indicator=ggsec49|login=/?action=login

200

34ms

—

—

✓ OK

GET (2nd-order)

template_engine.php?action=admin_render

RENDER:seed={{system('id')}}|store=/save|storefield=body|render=/?action=admin_render|indicator=uid=|login=/?action=login

200

13ms

—

—

🔍 GGC-NOSQL-089 8.8 HIGH P1 Confirmed NOSQL_INJECTION filter POST /save (JSON body field 'filter') 3/3 hits ▼

Flow

The 'filter' field from the JSON POST body is decoded via json_decode into an associative array. If the resulting array contains a '$where' key (i.e. the attacker sends {"filter":{"$where":"..."}}) the code enters the sleep(4) branch, simulating server-side JavaScript evaluation in MongoDB's $where operator. In a real MongoDB deployment this would allow arbitrary JavaScript execution on the database server. The sink is blind — the response is always {"status":"template_saved"} — so detection relies on response delay.

Attack Chain

1. GET ?action=login to obtain a session. 2. POST /save with JSON body containing filter as an object with a $where key carrying a JavaScript busy-wait. 3. Observe a ~4-5 second response delay confirming server-side evaluation of the injected operator.

Impact

RCE — Direct

CWE / CVSS

CWE-943 Improper Neutralization of Data in a Query (NoSQL) · CVSS 8.8 High (Base 9.8 Critical)

Untrusted input alters a NoSQL query (operator injection), bypassing authentication or leaking data.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RC:C

ⓘ Base 9,8 → Effective 8,8 — auth-gated (PR:L).

Compliance Impact

A03:2021 – Injection

PCI-DSS v4.0 Req 6.2.4 (injection/XSS) · ISO/IEC 27001:2022 A.8.28 · GDPR Art. 32 (security of processing)

MITRE ATT&CK

T1190 Exploit Public-Facing Application

Initial Access

Certainty / Access

Confirmed · 👤 Customer

Evidence strength

64%Medium evidenceEvidence score 64/100

+50 Confirmed (strong signal)
+6 Inferred from timing / HTTP 500 (no direct echo)
+3 Reproduced by 3 payload(s)
+5 Stable 2xx response

Proof of Concept

Reproduce:

curl -i -X POST 'http://172.26.203.184/template_engine.php/save' --data 'JSONBODY:{"body":"","filter":{"$where":"function(){sleep(5000);return true;}"}}'

Evidence (live response):

Proof: response took 4.0s while a non-vulnerable request returns in well under 1s — the server executed the injected delay (blind time-based injection; no data is echoed). Response body: {"status":"template_saved"}

Remediation

Use parameterized queries / prepared statements — never build queries by string concatenation.

Replace interpolated SQL with bound parameters (PDO/mysqli prepared statements, '?'/named placeholders).
For NoSQL, cast user input to the expected scalar type and reject array/operator inputs ((string)$x, type checks).
Apply least-privilege DB credentials; the web user should not own DDL or admin rights.
Add allowlist validation for structural elements that cannot be parameterized (column/table names, ORDER BY).

Refs: CWE-89 · OWASP: SQL Injection Prevention Cheat Sheet · CWE-943 (NoSQL)

Result	Method	URL	Payload	Status	Time	Detection	DB
⚠ VULN	`POST`	`http://172.26.203.184/template_engine.php/save`	JSONBODY:{"body":"","filter":{"$where":"var s=Date.now();while(Date.now()-s<5000){};return true;"}}	200	3961ms	nosql-time-based	—
⚠ VULN	`POST`	`http://172.26.203.184/template_engine.php/save`	JSONBODY:{"body":"","filter":{"$where":"sleep(5000)"}}	200	3983ms	nosql-time-based	—
⚠ VULN	`POST`	`http://172.26.203.184/template_engine.php/save`	JSONBODY:{"body":"","filter":{"$where":"function(){sleep(5000);return true;}"}}	200	3999ms	nosql-time-based	—

🔍 GGC-VULN-D0C 8.9 HIGH P1 Likely OUTDATED_COMPONENT apache 2.4.58 · CVE-2024-38475 HTTP Server / X-Powered-By banner 1/1 hits ▼

Flow

The server banner indicates apache 2.4.58, which the version range for CVE-2024-38475 (fixed in 2.4.60) would cover — version-indicated only, not confirmed exploitable (banner may be backport-patched; vulnerable config/module not verified).

Impact

RCE — Direct

CWE / CVSS

CWE-1104 Use of Unmaintained/Vulnerable Third-Party Component · CVSS 8.9 High (Base 9.8 Critical)

An unmaintained / known-vulnerable third-party component is in use; a published CVE may apply.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RC:R

ⓘ Base 9,8 → Effective 8,9 — probable (E:P/RC:R).

Compliance Impact

A06:2021 – Vulnerable and Outdated Components

PCI-DSS v4.0 Req 6.3.1 / 6.3.3 (patch mgmt) · ISO/IEC 27001:2022 A.8.8 · GDPR Art. 32 (security of processing)

MITRE ATT&CK

T1190 Exploit Public-Facing Application

Initial Access

Certainty / Access

Likely · 🔓 Unauthenticated

Evidence strength

75%Medium evidenceEvidence score 75/100

+50 Confirmed (strong signal)
+20 Direct detection (outdated-component)
+5 Stable 2xx response

Proof of Concept

Reproduce:

curl -i 'template_engine.php'

Evidence (live response):

Server banner 'Apache/2.4.58' matches CVE-2024-38475 (CWE-22, Critical): mod_rewrite improper output escaping → URL mapped to filesystem (RCE / source disclosure). Affected: version < 2.4.60. VERSION-INDICATED / UNVERIFIED — this is a banner-only match: (1) a backported distro pa…

Remediation

Upgrade the flagged component to a fixed release; version-indicated — verify against your actual (possibly backported) build.

Upgrade to the fixed version listed for the CVE (or a distro build with the backported patch).
Confirm the real installed version — a backported security fix can leave the banner version unchanged (avoid false positives).
Suppress the version banner (ServerTokens Prod / expose_php=Off / remove X-Powered-By) to reduce fingerprinting.
Track dependencies with SCA (composer audit / npm audit / Dependabot) and patch on a schedule.

Refs: CWE-1104 · OWASP A06:2021 Vulnerable & Outdated Components · NVD

Result	Method	URL	Payload	Status	Time	Detection	DB
⚠ VULN	`GET`	`template_engine.php`	outdated-component	200	0ms	outdated-component	—

🔍 GGC-VULN-637 6.8 MEDIUM P2 Likely OUTDATED_COMPONENT apache 2.4.58 · CVE-2024-38476 HTTP Server / X-Powered-By banner 1/1 hits ▼

Flow

The server banner indicates apache 2.4.58, which the version range for CVE-2024-38476 (fixed in 2.4.60) would cover — version-indicated only, not confirmed exploitable (banner may be backport-patched; vulnerable config/module not verified).

Impact

DOS — Direct

CWE / CVSS

CWE-1104 Use of Unmaintained/Vulnerable Third-Party Component · CVSS 6.8 Medium (Base 7.5 High)

An unmaintained / known-vulnerable third-party component is in use; a published CVE may apply.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RC:R

ⓘ Base 7,5 → Effective 6,8 — probable (E:P/RC:R).

Compliance Impact

A06:2021 – Vulnerable and Outdated Components

PCI-DSS v4.0 Req 6.3.1 / 6.3.3 (patch mgmt) · ISO/IEC 27001:2022 A.8.8 · GDPR Art. 32 (security of processing)

MITRE ATT&CK

T1190 Exploit Public-Facing Application

Initial Access

Certainty / Access

Likely · 🔓 Unauthenticated

Evidence strength

75%Medium evidenceEvidence score 75/100

+50 Confirmed (strong signal)
+20 Direct detection (outdated-component)
+5 Stable 2xx response

Proof of Concept

Reproduce:

curl -i 'template_engine.php'

Evidence (live response):

Server banner 'Apache/2.4.58' matches CVE-2024-38476 (CWE-476, High): mod_proxy null-pointer dereference → DoS via malicious backend response headers. Affected: version < 2.4.60. VERSION-INDICATED / UNVERIFIED — this is a banner-only match: (1) a backported distro patch may leave…

Remediation

Upgrade the flagged component to a fixed release; version-indicated — verify against your actual (possibly backported) build.

Upgrade to the fixed version listed for the CVE (or a distro build with the backported patch).
Confirm the real installed version — a backported security fix can leave the banner version unchanged (avoid false positives).
Suppress the version banner (ServerTokens Prod / expose_php=Off / remove X-Powered-By) to reduce fingerprinting.
Track dependencies with SCA (composer audit / npm audit / Dependabot) and patch on a schedule.

Refs: CWE-1104 · OWASP A06:2021 Vulnerable & Outdated Components · NVD

Result	Method	URL	Payload	Status	Time	Detection	DB
⚠ VULN	`GET`	`template_engine.php`	outdated-component	200	0ms	outdated-component	—

Security Headers

Header	Status	Risk	Recommendation
`Content-Security-Policy`	✗ MISSING	HIGH	Prevents XSS/injection. Use nonce or strict-dynamic.
`X-Frame-Options`	✗ MISSING	MEDIUM	Prevents clickjacking. Use DENY or SAMEORIGIN.
`X-Content-Type-Options`	✗ MISSING	LOW	Prevents MIME sniffing. Set to nosniff.
`Strict-Transport-Security`	✗ MISSING	MEDIUM	Enforces HTTPS. min-age=31536000; includeSubDomains.
`Referrer-Policy`	✗ MISSING	LOW	Limits referrer leakage. strict-origin-when-cross-origin.
`Permissions-Policy`	✗ MISSING	LOW	Restrict unused browser features (camera, mic, geo).