TEFuzz

TEFuzz is a specialized fuzzing framework designed to automatically detect and exploit template escape bugs in template engines, which can lead to remote code execution vulnerabilities. It was developed for research presented at USENIX Security '23 and provides a systematic approach to finding security flaws in template sandboxes.

Key Features

• Context-Sensitive Code Wrapping — Uses php-parser to intelligently wrap code for fuzzing.
• Error Message Modeling — Analyzes and models error responses to guide fuzzing.
• Sink Detection — Identifies interesting test cases that may indicate vulnerabilities.
• Proof-of-Concept Generation — Automatically generates PoCs for detected template escape bugs.
• Exploit Generation — Creates working exploits from validated vulnerabilities.

Philosophy

TEFuzz adopts a tailored, context-aware fuzzing approach to uncover complex template escape vulnerabilities that traditional fuzzing might miss, emphasizing automation in both detection and exploitation.