Collected research

ESI Injection Part 2: Abusing specific implementations

24/7 managed detection, response, and expert cybersecurity services

Philippe Arteau · GoSecure · 2 May 2019

Three vendor-specific abuses of injected Edge Side Include tags: an inline fragment writes a fetchable poisoned page into the cache, a remote stylesheet on an include reaches a Java XSLT engine and runs commands, and a newline inside a request-header value injects a Host header for limited SSRF against Oracle Web Cache.

Record

Document

24/7 managed detection, response, and expert cybersecurity services

Researcher

Philippe Arteau

Published by

GoSecure

Date

2 May 2019

Topic

Injection

In the archive

• Collected in the 2019 research round

Related sources

• Beyond XSS: Edge Side Include Injection
• ESI Injection at DEF CON

Tags

• cache-poisoning
• ssrf
• rce
• header-injection
• xss
• cache
• reverse-proxy
• java
• cve
• owasp-a03-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Philippe Arteau, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.