SSTI Explained

Server side template injection happens when user input is embedded into a template that is then evaluated on the server, letting an attacker inject template syntax that the engine executes. Depending on the engine, it often escalates all the way to remote code execution. It is detected by injecting a simple mathematical expression and seeing if the server evaluates it.

What SSTI is

Template engines build pages by evaluating expressions inside templates. If user input is placed into the template itself rather than passed as data, the attacker's input becomes code the engine runs. The distinction between data and template is the whole bug.

Detecting it

The universal first test is a mathematical expression in template syntax. If the response shows the result rather than the literal text, the engine evaluated it:

# input
${7*7}   or   { {7*7} }
# if the response shows 49, the template engine executed it

Identify the engine

Different engines use different syntax and have different escalation paths. After confirming injection, fingerprint the engine with payloads that behave differently across engines. The engine determines how far you can go.

Escalating to RCE

Once you know the engine, you navigate its object model to reach functions that execute system commands. In many engines this is a well trodden path from a confirmed injection to a shell. That is why SSTI is usually rated critical.

Where it hides

• Anywhere user input appears in a generated page or email
• Customisable templates and themes
• Report and document generators
• Any feature that lets users control formatting

The fix

1. Never put user input into a template as template code
2. Pass user input as data to a pre defined template
3. Use a sandboxed or logic less templating engine where possible
4. Do not build templates by string concatenation with user input

Practise this

SSTI is one of the more advanced web bugs and a strong skill to have. Practise on vulnerable apps on Hacklido.