Server-Side Template Injection (SSTI)

Also Known As

TL;DR

Explanation

SSTI occurs when an application passes unsanitised user data into a template engine (Twig, Smarty, Blade) which then evaluates it as template syntax. An attacker who discovers the injection point can escalate to full remote code execution by exploiting the template engine's built-in object access. In PHP, Twig in sandbox mode mitigates the risk; never pass raw user input to Environment::createTemplate() or render().

How It's Exploited

Common Misconception

Why It Matters

Common Mistakes

• Passing user input as the template string to render() instead of as a variable to a fixed template.
• Using Twig with autoescape disabled and reflecting user input into the template.
• Not sandboxing template rendering when user-defined templates are a feature of the application.
• Confusing output encoding (which prevents XSS) with template injection (which requires not including user input in the template structure).

Code Examples

$twig->render($userInput, $data);

$twig->render('fixed_template.html.twig', ['query' => htmlspecialchars($userInput)]);

References

• ↗ https://portswigger.net/web-security/server-side-template-injection
• ↗ https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/18-Testing_for_Server-Side_Template_Injection

Tags

Related Terms