2

I just conducted an automated web scan with Burp Suite Pro. The scanner result indicated that our website had a high severity of code injection. It gave the following proof:

Figure 1 - Issue detail and request

Figure 2 - Reponse

However, I don't understand why it interpreted like that:

"The application appears to evaluate user input as code. It was instructed to sleep for 0 seconds, and a response time of 1.1369998455 seconds was observed. It was then instructed to sleep for 10 seconds, which resulted in a response time of 15.8949999809 seconds"

Where to find the response which showed that the web app followed the instruction to sleep for xxx seconds? And why did it assess that the application appears to evaluate user input as code given that proof?

(I'm not specialized in web security pentest, but was assigned to do this task due to staff skeleton).

Improve this question

1 Answer 1

Reset to default
5

The automated scan result is showing a potentially exploitable issue. Like every other automated scan result, you would have to perform a false positive analysis.

The easiest way to analyze this would be to perform a code review to see how the affected parameter is handled server side. If this is a blackbox/ graybox security test and looking at the code is not possible, then:

You need to use the Burp proxy to replay the request using the repeater tool and manipulating the sleep time value to see if the results are consistent (see bottom right corner in repeater tab for response time). If the behavior persists you might want to try injecting some other commands to confirm this. e.g. a command that makes the host connect back to a web server controlled by you (this depends on other variables such as network access for the host).

The vulnerability is server side code injection. The scanner injected the sleep command in the password field twice and noticed that the server took a longer than usual time to respond when it was asked to sleep for 10 seconds. This indicates that command injection may be possible.

Improve this answer
1
  • Following your useful advice, I took a look at the bottom right corner of response tab, and saw that all responses took less than 1 second. I think that I may evaluate this severity as false positive. Still don't know why Burp Suite Scanner claimed that the "confidence" is "firm" in this case.
    – sanba06c
    Commented May 17, 2020 at 2:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .