Server-Side Template Injection (SSTI) -- Offensive Methodology

SSTI exists wherever user-controlled input is concatenated into a server-side template string and the engine evaluates it as code. The engine executes attacker-supplied directives, granting access to the language runtime and, in nearly every engine, remote code execution through the host language's object model. You encounter SSTI in any application passing raw user input to functions like render_template_string(), Template(), or compile().

CWE-1336. MITRE ATT&CK T1190.

Quick Workflow