Which Injection Attack Exploits SSI Directives in a Web Application?
Calvin, a software developer, uses a feature that helps him auto-generate the content of a web page without manual involvement and is integrated with SSI directives. This leads to a vulnerability in the developed web application as this feature accepts remote user inputs and uses them on the page. Hackers can exploit this feature and pass malicious SSI directives as input values to perform malicious activities such as modifying and erasing server files. What is the type of injection attack Calvin's web application is susceptible to?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you can identify the injection class from the presence of SSI directives in a dynamically generated page — the trap is picking the broader, trendier 'server-side template injection' label.
When a page-generation feature feeds remote user input into Server-Side Includes (SSI) directives, attackers can inject #exec, #include or #config statements to read, modify or erase files on the web server. The correct classification here is server-side includes injection (D), not a generic template or CRLF flaw.
Choosing B (server-side template injection) because the question mentions auto-generating page content; SSTI concerns template engines such as Jinja2 or Twig, whereas the question explicitly names SSI directives.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Server-Side Includes are a web server feature (Apache's mod_include, IIS SSI) that lets a page embed directives such as<!--#include file="..."-->, <!--#exec cmd="..."--> and <!--#config...--> which the server resolves before returning HTML. Calvin's page-generation feature accepts remote input and places it into a page that the SSI engine still parses, so crafted input is interpreted as a directive rather than as inert text. That is precisely server-side includes injection, the option D. The impact described — modifying and erasing server files — matches #exec and #include abuse, which can run OS commands under the web server's account and touch files outside the web root. As shaody noted in the comments, attackers "exploit this feature to pass malicious SSI directives as input values", which is the definition of this attack class.Why the Other Options Are Wrong
CRLF injection (A) is about smuggling carriage-return/line-feed sequences into HTTP headers or logs to split responses or poison caches; it does not involve SSI directives being parsed by the server. Server-side template injection (B) is superficially similar but targets template engines (Jinja2, Twig, Freemarker) where user input is concatenated into a template and evaluated — the question never mentions a template engine or its syntax. Server-side JavaScript injection (C) requires the server to evaluate JavaScript (Node.jseval, or a JS engine embedded in the app), and again no JS is described. Only D names the exact mechanism the scenario describes: SSI directives being fed remote input.Community Comment Notes
All recorded votes on this question land on D, and the commenters consistently identify the presence of SSI directives as the decisive clue. insaniunt simply records "Server-side includes injection" as the pick, while shaody explains that the injected values become malicious SSI directives that drive the attack. LordXander's note is an internal CEHv12 question-bank reference rather than a technical argument, but it agrees with the same conclusion. There is no dissent in the comment thread, so treat SSI as the anchor keyword whenever this scenario reappears.Official Reference
Exam Strategy
On injection questions, match the literal technology named in the stem — SSI directives means SSI injection, template syntax means SSTI, header delimiters mean CRLF. CEH writers rarely use the newest terminology when an older, narrower term fits exactly.
Frequently Asked Questions
Why is server-side template injection (B) wrong when the page content is auto-generated?
SSTI requires a template engine evaluating user input; the stem names SSI directives, a web-server feature, so SSI injection is the precise term.
What SSI directives do attackers typically inject?
Common payloads are #exec cmd to run OS commands, #include to read files, and #config or #echo to alter page output.