DB.
Courses

Server-Side Template Injection
OSWE · Chapter 20

Server-Side Template Injection

Server-Side Template Injection (SSTI) happens when user input is concatenated directly into a template string before rendering, rather than passed in as data. Depending on the template engine, this can escalate from simple HTML injection to full remote code execution.

Key concepts

  • Detection probe: submit a mathematical expression like `{{7*7}}` — if the rendered output shows `49`, the template engine is evaluating your input as code, not data.
  • Different template engines (Jinja2, Twig, Freemarker) have different syntax and different levels of sandboxing — identifying the exact engine is a required step before exploitation.
  • Some engines expose enough functionality in their expression language alone to reach OS command execution directly from a template payload.
  • Prevention: never concatenate user input into template source; use "logic-less" template engines (e.g. Mustache) where practical, and sandbox any environment that must evaluate user-influenced templates.

Example

# Detection probe in a name/greeting parameter
http://vulnerable-website.com/?name={{7*7}}
# If page renders "49", template injection is confirmed

Try it yourself

On a lab SSTI challenge, submit the `{{7*7}}` probe, confirm code evaluation, then try a small set of engine-fingerprinting payloads to identify whether the backend is Jinja2 or Twig.

ReferenceSearch video walkthroughs

@ Daniel Burlacu