CWE-97 (Web页面中服务端引用(SSI)转义处理不恰当) — Vulnerability Class 5

CWE-97 represents a critical input validation weakness where web applications fail to sanitize user-supplied data before embedding it into server-side include directives. Attackers typically exploit this vulnerability by injecting malicious SSI commands, such as file inclusion or command execution instructions, into untrusted input fields like URLs or form submissions. If the server processes these directives without proper filtering, it can inadvertently execute arbitrary code or expose sensitive system files, leading to severe data breaches or complete server compromise. To mitigate this risk, developers must rigorously validate and encode all user inputs, ensuring that special characters are escaped or stripped before rendering. Implementing strict allowlists for permitted input formats and avoiding dynamic SSI generation with untrusted data are essential practices. Additionally, employing modern templating engines that separate logic from data can significantly reduce the attack surface by preventing direct interpretation of user input as executable server commands.