sc-ssti

SC: Server-Side Template Injection (SSTI)

Purpose

Detects server-side template injection vulnerabilities where user input is embedded into template strings before compilation/rendering, allowing attackers to execute arbitrary code on the server. Covers Jinja2, Twig, Freemarker, Velocity, Pug, Handlebars, ERB, Mako, Thymeleaf, and Go templates.

Activation

Called by sc-orchestrator during Phase 2 when template engines are detected.

Phase 1: Discovery

File Patterns to Search

**/*.py, **/*.php, **/*.java, **/*.rb, **/*.js, **/*.ts, **/*.go,
**/templates/*, **/views/*, **/*template*, **/*render*, **/*view*

Keyword Patterns to Search

# Python/Jinja2
"render_template_string(", "Template(", "Environment(",
"from_string(", "jinja2.Template("

# PHP/Twig
"$twig->createTemplate(", "Twig\\Template", "renderString("

# Java/Freemarker/Velocity/Thymeleaf
"new Template(", "freemarker", "VelocityEngine",
"templateEngine.process(", "StandardDialect"

# Ruby/ERB
"ERB.new(", "render inline:", "Erubis"

# JavaScript/Pug/Handlebars/EJS
"pug.render(", "pug.compile(", "Handlebars.compile(",
"ejs.render(", "nunjucks.renderString("

# Go
"template.New(", "text/template", "html/template",
".Parse(", "template.Must("

Semantic Patterns

1. User input passed as the template STRING (not as template DATA)
2. String concatenation used to build template content before compilation
3. Template created from user-controlled source (database, HTTP parameter)
4. render_template_string() instead of render_template() in Flask

Phase 2: Verification

Key Distinction

The vulnerability occurs when user input becomes part of the TEMPLATE CODE, not the template DATA:

# SAFE: User input as template data (parameterized)
render_template('hello.html', name=user_input)

# VULNERABLE: User input as template code
render_template_string(f"Hello {user_input}")
# If user_input = "{{7*7}}", the template engine evaluates it as 49
# If user_input = "{{config.items()}}", it leaks Flask config