RLAgent-GSSTI: Automated Grey-Box SSTI Vulnerability Detection Based on Reinforcement Learning Agent

With the wide application of template engines in Web development, Server-Side Template Injection (SSTI) attacks have become common security issues. Traditional white-box or black-box vulnerability methodologies exhibit notable limitations in SSTI vulnerabilities, particularly in terms of automation efficacy and the prevalence of false negatives. This paper proposes RLAgent-GSSTI, an automated grey-box SSTI vulnerability detection framework based on reinforcement learning (RL) agent. First, we propose an SSTI risk prediction method combining the Rainbow algorithm and CodeQL, using a RL agent to automatically generate Query Language (QL) rules for code database security auditing. Second, we develop an SSTI injection detection approach based on Hierarchical Reinforcement Learning (HRL) agents to generate attack payloads for vulnerability identification and exploitation. Finally, we have developed an automated grey-box vulnerability detection framework capable of efficiently and accurately detecting SSTI vulnerability. We tested the SSTI risk prediction method against existing advanced static code analysis methods and showed that our method has a low false negative rate (FNR) of 28.10%, while several advanced static code analysis tools have FNRs as high as 100.00%. The injection detection method outperforms advanced scanners in filtered environments and enables automated sandbox escapes for remote code execution. Notably, RLAgent-GSSTI’s FNR is as low as 11.28%, outperforming the effectiveness of traditional static analysis tools and scanners. Code available: https://github.com/Lgoprog/RLAgent-GSSTI