View Attack Vector

General Information

Server Side Javascript Injection

Variants:
Direct Persistent Session

Also Known As:
NoSQL Injection - deprecated

Vector Type:
Attack

Relevance:
Generic

Layer:
Application-Level

Platforms:
Any

Target Type:
Application

Affected Mechanisms:
Input Validation, Syntax Escaping

Invented In:
01/07/2011

Added In:
08/12/2014

Vector Operation Method:
Malicious inputs can affect the structure of SSJS code

Direct Variant:

SSJS Injection

Variant Title:
SSJS Injection

Typical Severity:
Critical

Resources:

Wiki

White Papers:

Paper I

Learn More:

Persistent Variant:

Stored SSJS Injection

Also Known As:
Persistent SSJS Injection

Typical Severity:
Critical

Resources:

White Papers:

Learn More:

Session Variant:

SSJS Injection via Session Puzzling

Also Known As:
Session SSJS Injection

Typical Severity:
Critical

Resources:

White Papers:

Learn More: