SSTI

Understanding SSTI (Server-Side Template Injection)

What is SSTI? Server Side Template Injection (SSTI) is a vulnerability that allows an attacker to inject malicious templates into the server-side processing pipeline. These templates, when rendered, can execute arbitrary code on the server, leading to unauthorized access, data theft, or full server compromise.

How SSTI Works: SSTI typically occurs when an application uses unsanitized user input to build dynamic templates. If this input is rendered by a templating engine without proper validation, an attacker can insert malicious code that is executed on the server-side. Common templating engines like Jinja2, Freemarker, and Velocity are vulnerable to such attacks.

Why SSTI Matters: - Remote Code Execution: An attacker can inject code that gets executed by the server. - Data Exfiltration: Malicious code can be used to steal sensitive information. - Denial of Service: Malicious templates can overload the server and cause service interruptions.

Prevention: - Input Sanitization: Validate and sanitize user inputs to prevent unwanted code execution. - Use Safe Templating Engines: Consider using safer, less flexible templating engines. - Template Context Isolation: Ensure that user input is never mixed with template contexts.

This is the printer-friendly version. See the colour SSTI flyer.