Server-Side Template Injection (SSTI)

What Is Broken and Why

SSTI occurs when user-supplied data is concatenated into a template string that is then rendered by a server-side template engine. Unlike XSS, execution happens on the server. Template engines provide access to the application runtime environment, enabling attackers to traverse object hierarchies, access internal classes, and ultimately execute arbitrary OS commands. The root cause is using templates as string formatting mechanisms fed with untrusted input rather than rendering only trusted template files.

Key Signals

• User input is reflected in responses as if processed (math expressions evaluated, not echoed)
• Parameters controlling page layout, email templates, error messages, or notification content
• {{7*7}} returns 49 (Jinja2, Twig); ${7*7} returns 49 (Freemarker, Velocity); <%= 7*7 %> returns 49 (ERB)
• Error messages referencing template engines (Jinja2, Twig, Freemarker, Velocity, Smarty, Pebble)
• Python/Java stack traces in response
• Custom error pages that echo request parameters