ascanrules: Added Detection for SSTI when a Redirect Occurs

[bkollmar]

Overview

In OWASP Juice Shop, a 302 redirect occurred after the SSTI payload was sent. This caused the POST response to contain information describing the redirect instead of proof that this field was vulnerable to SSTI. By adding one extra line allowing the sendandreceive function to follow the redirect the POST response now contains the changed username that proves there is an SSTI vulnerability and an alert is raised.

Related Issues

This solves issue #8816

Checklist

• Update help
• Update changelog
• Run ./gradlew spotlessApply for code formatting
• Write tests
• Check code coverage
• Sign-off commits
• Squash commits
• Use a descriptive title

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[bkollmar]

I have read the CLA Document and I hereby sign the CLA

[kingthorin]

Please investigate the unit test failures. Your change seems to have impacted some expected behaviour.

You should add test(s) to cover the new behaviour as well.

Also CHANGELOG.md should be updated.

[psiinon]

Checkmarx One – Scan Summary & Details – 2e3a1199-e07e-4723-940a-16e60be8a32f

New Issues (5)

Checkmarx found the following issues in this Pull Request

Severity	Issue	Source File / Package	Checkmarx Insight
	CVE-2025-27152	Npm-axios-1.7.4	details Recommended version: 1.8.2 Description: Axios is a promise-based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to... Attack Vector: NETWORK Attack Complexity: LOW ID: BNiaFb57%2BJdfsloXeRcbKdUGSNLP872v8XDr3eMoTJw%3D Vulnerable Package
	CVE-2024-55565	Npm-nanoid-3.3.7	details Recommended version: 3.3.8 Description: The package nanoid versions through 3.3.7 and 4.0.0 through 5.0.8 mishandle non-integer values. Attack Vector: NETWORK Attack Complexity: LOW ID: y7rwBIK8%2FbhxO%2B%2F27TLd0fZ9zkq0ybmmBwE3pts%2FuRA%3D Vulnerable Package
	CVE-2025-31125	Npm-vite-4.5.9	details Recommended version: 4.5.10 Description: Vite is a frontend tooling framework for javascript. Vite exposes the content of non-allowed files using `?inline&import` or `?raw?import`. Only ap... Attack Vector: NETWORK Attack Complexity: HIGH ID: Hl0CL0%2FEnqOVE1vl2S9OxTNLQM6YYvF2%2F1bfI%2FXJUVc%3D Vulnerable Package
	CVE-2025-31486	Npm-vite-4.5.9	details Recommended version: 4.5.10 Description: A vulnerability in Vite allows the contents of arbitrary files to be returned to the browser. By appending "?.svg" along with "?.wasm?init" or sett... Attack Vector: NETWORK Attack Complexity: HIGH ID: TJkiunitQSbfjiU8Wc%2Bt6FGH6wJyQXWeANtTo4kbBCc%3D Vulnerable Package
	Cxbb85e86c-2fac	Npm-esbuild-0.18.20	details Recommended version: 0.25.0 Description: esbuild is an extremely fast bundler for the web, allowing any website to send any request to the development server and read the response due to d... Attack Vector: NETWORK Attack Complexity: HIGH ID: tJSbfBK4zf3YvqC4NxdpVHGx4UPZWeqFFyhxo4Pop%2Bw%3D Vulnerable Package

Fixed Issues (9)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	Use_Of_Hardcoded_Password	/addOns/authhelper/src/main/java/org/zaproxy/addon/authhelper/internal/AuthenticationBrowserHook.java: 44
	Use_Of_Hardcoded_Password	/addOns/authhelper/src/test/java/org/zaproxy/addon/authhelper/internal/ClientSideHandlerUnitTest.java: 67
	Use_Of_Hardcoded_Password	/addOns/authhelper/src/test/java/org/zaproxy/addon/authhelper/AuthDiagnosticCollectorUnitTest.java: 236
	Heap_Inspection	/addOns/authhelper/src/main/java/org/zaproxy/addon/authhelper/internal/db/TableJdo.java: 78
	Heap_Inspection	/addOns/authhelper/src/main/java/org/zaproxy/addon/authhelper/AuthUtils.java: 466
	Heap_Inspection	/addOns/authhelper/src/main/java/org/zaproxy/addon/authhelper/AuthTestDialog.java: 264
	Heap_Inspection	/addOns/authhelper/src/test/java/org/zaproxy/addon/authhelper/AuthUtilsUnitTest.java: 994
	Heap_Inspection	/addOns/authhelper/src/test/java/org/zaproxy/addon/authhelper/AuthUtilsUnitTest.java: 971
	Heap_Inspection	/addOns/authhelper/src/test/java/org/zaproxy/addon/authhelper/AuthUtilsUnitTest.java: 1018

[bkollmar]

I am still struggling to find out why an SSRF vulnerability has been introduced in my code. I thought changing it to not follow redirects would solve this, but it hasn't. Any thoughts? Or advice on how to get more details on why/where this vulnerability may be emerging?

[kingthorin]

Are you referring to something in the results above from psiinon? You can ignore that.