A Server-side JavaScript injection vulnerability allows the attacker to run arbitrary JavaScript code on the server. Web Applications that pass user input to functions like eval(), setTimeout() and setInterval() are potentially vulnerable.

The impact of this vulnerability ranges from an effective denial-of-service attack to File System access on the server.

How to fix

• generic

• To prevent a Server-side JavaScript injection vulnerability, you should validate all user input on the server-side before processing.

  You should also consider the following:

  • Do not use the eval() function to parse user inputs.
  • If you need to parse JSON input, use a safer alternative such as JSON.parse().
  • Include "use strict"; at the beginning of a function.