Skip to main content

58. SSTI: Complete Analysis of Server-Side Template Injection

SSTI (Server-Side Template Injection) is a vulnerability that occurs when a template engine interprets user input as code. It looks like XSS, but it executes on the server and can lead to RCE.

How It Works​

What if entering {{7*7}} prints 49? The template engine performed the calculation directly—SSTI is confirmed.

Each engine has different syntax:

  • Jinja2 (Python): expose configuration information with {{config}}
  • Twig (PHP): {{_self.env.getFilter("exec")("id")}}
  • FreeMarker (Java): ${"freemarker.template.utility.Execute"?new()("id")}

Jinja2 RCE Payload​

{{ ''.__class__.__mro__[1].__subclasses__()[396]('id',shell=True,stdout=-1).communicate() }}

This follows the class chain through __mro__ and calls subprocess.Popen.

Detection​

Identify the engine with fuzzing payloads:

  • ${7*7} → FreeMarker, Velocity
  • {{7*7}} → Jinja2, Twig
  • <%= 7*7 %> → ERB

Defense​

Never insert user input directly into a template string. Rendering must always pass variables separately, as in render_template_string(template, **context).

When you see an SSTI challenge in a CTF, try {{7*7}} first. The moment a number appears, half the challenge is already solved. 🔥