Server-Side Template Injection (SSTI)
SSTI occurs when user input is embedded directly into a server-side template engine. Attackers can inject template directives to execute arbitrary code on the server, read files, or achieve remote code execution.
Overview
Server-Side Template Injection is a vulnerability where user input is unsafely embedded into a server-side template. Template engines like Jinja2, Twig, Freemarker, and Velocity process templates on the server before returning HTML. When attackers can inject template syntax, they can escape the template sandbox and execute arbitrary code on the underlying server.
Types & Variants
Direct SSTI
User input is placed directly into a template string and processed by the engine.
Sandbox Escape
Exploiting template engine features to break out of sandboxed execution environments.
Impact
Remote code execution, full server compromise, data exfiltration, reading sensitive server files.
Examples
Jinja2 RCE
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}Detection Probe
{{7*7}} => 49 confirms template injectionRemediation
Never pass user input directly into template engines. Use logic-less templates, sandbox template execution environments, and validate all inputs.
Never embed user input directly in templates
Use logic-less template engines (Mustache, Handlebars)
Sandbox template execution with restricted built-ins
Apply strict input validation and output encoding
Related SuperClue scanner checks
These scanner checks look for signs of Server-Side Template Injection (SSTI). What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works