Hi i did a scan on getastra.com after updating the sp page builder to the latest version 3.8.5 and found some issue with Server Side Template Injection issue:
/components/com_sppagebuilder/assets/css/sppagebuilder.css?f53ba91a9cc92bb2348e4eab5b1ff3a1=%3C%25%3D+foobar+%25%3E
/components/com_sppagebuilder/assets/css/font-awesome-v4-shims.css?f53ba91a9cc92bb2348e4eab5b1ff3a1=%3C%25%3D+foobar+%25%3E
/components/com_sppagebuilder/assets/css/font-awesome-5.min.css?f53ba91a9cc92bb2348e4eab5b1ff3a1=%3C%25%3D+foobar+%25%3E
Report:
Details of Vulnerability
Server Side Template Injection (SSTI) occurs when user input is directly embedded into the template without any proper sanitization, a hacker can use this vulnerability to inject malicious code and try to achieve remote code execution.
Suggested Fixes
Always use proper functions provided by the template engine to insert data, if that is not possible try to sanitize user input as efficiently as possible.
How can I fix this without breaking the template?
