SSTI 101
Last updated
Was this helpful?
Last updated
Was this helpful?
This can lead to remote code execution, data exposure, and unauthorized access, as attackers can manipulate the server-side template engine to run arbitrary code.
Validate and sanitize all user inputs, avoid using untrusted data in templates, and restrict the template engine's features to limit the potential impact of injections.
The content below is based on OffSec's course.
Templating Engines are used to display dynamically generated content on web applications. They replace the variables inside a template file with actual values and display these values to the client. For instance, if we wanted to draft an email for every customer such as:
We could create a template like:
And then fill out the variables:
PHP
Server Side
Java (usually)
Server Side
JavaScript
Mostly Server Side
Python
Server Side
JavaScript
Both
Multiple
Varies
Python
We can use polyglots to induce errors. The error polyglot produces an error message to 44 template engines. However, errors might be caught by the application. The non-error polyglots are constructed in such a way that at least one of them does not throw an error, but renders the polyglot modified for all popular template engines.
Thrown errors, revealing the vulnerability and potentially the template engine.
Absence of the payload in the reflection, or parts of it missing, implying the server processes it differently than regular data.
Plaintext Context: Distinguish from XSS by checking if the server evaluates template expressions.
Code Context: Confirm vulnerability by altering input parameters. For instance, changing greeting in http://vulnerable-website.com/?greeting=data.username to see if the server's output is dynamic or fixed, like in greeting=data.username}}hello returning the username.
Template engines aimed at web applications can render the HTML template server-side or client-side. The former could result in , while the latter could only result in . Some of the most popular templating engines can be found below:
(aka Jade)
The content below is based on Hackmanit's article .
Tools like , , and (Burp Pro) can automatically test for SSTI flaws by injecting combinations of special characters in template expressions (${{<%[%'"}}%\). Vulnerability indicators include:
