Offensive security assessments
Server-Side Template Injection (SSTI)
Server-Side Template Injection (SSTI) is a type of security vulnerability that occurs when user input is insecurely embedded in server-side templates, allowing an attacker to execute arbitrary code on the server. This can lead to data exposure, remote code execution, and other m…
Why it matters
Server-Side Template Injection (SSTI) is a type of security vulnerability that occurs when user input is insecurely embedded in server-side templates, allowing an attacker to execute arbitrary code on the server. This can lead to data exposure, remote code execution, and other malicious activities.
How we test it
Our operators follow a structured checklist for this topic, adapted to your API surface and authentication model.
Testing approach
- For a web application to be vulnerable to SSTI, the following conditions typically need to be met: 1
- Use of a Template Engine: The application must utilize a server-side template engine (e.g., Jinja2, Twig, Django templates)
- Insecure Handling of User Input: User input is directly or indirectly passed to the template engine without proper sanitization or validation
- Dynamic Template Rendering: The application allows dynamic rendering of templates based on user input.
- Accept user input to dynamically generate content (e.g., search forms, profile pages).
- Use popular template engines, such as:
- Jinja2 (Python)
- Django Templates (Python)
What we look for
- For a web application to be vulnerable to SSTI, the following conditions typically need to be met: 1
- Use of a Template Engine: The application must utilize a server-side template engine (e.g., Jinja2, Twig, Django templates)
- Insecure Handling of User Input: User input is directly or indirectly passed to the template engine without proper sanitization or validation
- Dynamic Template Rendering: The application allows dynamic rendering of templates based on user input.
- Accept user input to dynamically generate content (e.g., search forms, profile pages).
- Use popular template engines, such as:
- Jinja2 (Python)
- Django Templates (Python)
Related topics
| Topic | Summary |
|---|---|
| Application Logic Flaws | Application Logic Flaws occur when a web application's normal logic or workflow can be manipulated, allowing attackers to bypass security measures or misuse functionality in unexpected ways. |
| Arbitrary Cookie Flags | Cookies that hold session or sensitive data are set without the proper security flags (Secure, HttpOnly, SameSite). This lets cookies travel over cleartext, be read by JavaScript, or be sent on cross-site requests, enabling theft and CSRF. |
| Back Button Attack | After a user logs out (or on a shared device), pressing the browser Back button or reopening cached pages reveals sensitive data or restores an authenticated view. This happens when the server lets responses be cached and does not fully invalidate the session. |
| Broken Authentication | Flaws in how an application confirms a user's identity, letting attackers compromise passwords, tokens, or sessions and assume other users' identities. It is one of the highest-impact web risks (OWASP Top 10: Identification and Authentication Failures). |
| Brute Force Attack | An attacker systematically tries many credentials, tokens, or values until one works. It succeeds when an endpoint lacks rate limiting, lockout, or sufficient secret entropy. |
| Captcha Bypass | A CAPTCHA is meant to block automated requests, but flawed implementation lets attackers skip or solve it programmatically. Bypassing it re-enables brute force, spam, and other automation the control was meant to stop. |