ssti

Server-Side Template Injection Detection

Overview

Server-side template injection happens when untrusted input becomes part of the template a server-side engine evaluates, rather than a value the template merely prints. Template engines are interpreters: they resolve expressions, traverse object graphs, call methods, and in most engines reach language builtins. When a handler concatenates a name, a subject line, or a stored snippet into the template source before rendering, the attacker's payload is executed on the server with the application's privileges. The attacker is anyone who can influence such a value — an anonymous visitor filling a form, a customer editing a profile, or a semi-trusted content editor supplying a snippet the platform never intended to be code. What they gain scales with the engine: at the top end, reflection or an operating-system handle reached through the object graph gives remote code execution; even in a restricted engine, the template context exposes configuration objects, secrets, environment values, and file access. This skill finds it by locating every render, compile, or evaluate call whose template argument is not a constant, checking each site in parallel, and merging the results into <output_dir>/ssti-results.md.

What it is NOT

• Cross-site scripting (/websec:xss): the injected markup is executed by the browser, not by the server. Test: does the engine evaluate the payload as its own expression syntax, or does the payload reach the response as literal text that the browser then runs? If template syntax comes back unchanged and only HTML or script executes, it is XSS. Template injection often produces XSS as a lesser outcome; the root cause and fix still differ.
• Client-side template evaluation (/websec:dom-based): a front-end framework evaluating an expression in the page is a browser-side issue ending in DOM XSS, not server execution. Test: where does the evaluation happen?
• Command injection (/websec:os-command-injection): the payload is interpreted by a shell. Test: is the sink a render call or a process launch? A template that reaches a shell helper is both — classify the template sink here and note the chain.
• Unsafe deserialization (/websec:deserialization): execution comes from rebuilding an object graph from serialized bytes, with no template engine involved.
• Path traversal (/websec:path-traversal): a template name concatenated into a filesystem path that loads an arbitrary file is traversal; the same name resolving to an attacker-supplied template body is this class. Say which one the evidence supports.
• Not a finding: a constant template rendered with untrusted values passed as context variables; a template chosen through a fixed map of allowed names; a static template file that merely prints a user's data; string formatting with no engine behind it; templates under version control that no request can alter.