CWE-97, Improper Neutralization of Server-Side Includes (SSI) Within a Web Page, applies when a product generates a web page and does not neutralize user controllable input that could be interpreted as a server-side include directive.
SSI is an old web server feature. The server scans a page for special comment style directives and replaces them with content, such as a file or the output of a command. MITRE lists the weakness as not language specific and tied to web servers.
How it happens
Suppose a guestbook writes visitor names into a page that the server processes for SSI.
<!-- Page template, processed for SSI by the web server -->
<p>Welcome back, USER_INPUT_HERE</p>
A visitor who submits a directive instead of a name now has the server evaluating their text. A directive that includes a file can disclose it. A directive that executes a command can run one.
The key condition is two features meeting: the server parses the page for SSI, and the page contains attacker text that was never encoded.
What an attacker gains
MITRE lists confidentiality, integrity and availability, with the ability to execute unauthorized code or commands. That is the worst case on the list, so any page that passes through an SSI parser deserves attention.
How to find it
MITRE's record gives no specific detection methods for this weakness, so use basic checks. First, find out whether SSI is enabled on your web servers at all. Many deployments never use it. Second, if it is enabled, test every place where user text lands in a processed page by submitting a harmless directive and seeing whether the server acts on it.
How to fix it
The most reliable fix is to turn SSI off where you do not need it. If you do need it, neutralize user input so it cannot form a directive: encode angle brackets and other markup characters on output, and restrict what SSI can do, in particular disabling command execution. Prefer a modern template engine that escapes by default and keep user data out of pages that the server post-processes.
Quick check
What two conditions must hold for CWE-97?
The web server must process the page for SSI directives, and user controllable input must reach that page without being neutralized.
