CWE-97 Server-Side Include Injection
What this means
SiteShadow flagged server-side include (SSI) directives being built from untrusted input. SSI features can include files or execute commands depending on server configuration.
Why it matters
SSI injection can read files or execute commands on the server.
- File disclosure (include arbitrary files).
- Command execution in unsafe configurations.
- Often appears when templates or legacy server features are used with user input.
Safer examples
1) Disable SSI where not needed
Turn off SSI processing in your server for user-controlled content.
2) Don't build include directives from user input
Use allowlists of known includes or server-side templates that don't interpret directives.
3) Treat includes as privileged
If includes are needed, ensure paths are fixed/allowlisted and not user-controlled (see CWE-23 / CWE-36).
How SiteShadow detects it (high level)
- Detects SSI directive patterns in server-rendered content.
- Flags cases where directive content is influenced by request/user input.
References
- CWE-97: https://cwe.mitre.org/data/definitions/97.html
---