Server-Side Template Injection (SSTI) Security

Web application development plays a vital role for many organizations and businesses in today’s digital age. However, ensuring the security of these applications and preventing exploitation by malicious attackers is not always straightforward. Server-Side Template Injection (SSTI) vulnerabilities represent a significant security risk in web applications. In this article, we will explore what SSTI is, how it works, and how to safeguard against potential attacks.
Before you start, we recommend that you read our article on what is a domain name.

What is SSTI?

SSTI is a security vulnerability that arises when template engines used in web applications are executed in an insecure manner. Template engines are often employed to dynamically generate content by combining user data with templates. These templates may contain values that can be influenced or directly provided by the user.

SSTI attacks aim to manipulate template engines into incorrectly interpreting input from users, causing them to execute malicious code within the application’s runtime environment. Such attacks commonly occur when the application fails to handle input securely

How does SSTI work?

To carry out an SSTI attack, the attacker usually targets template delimiters within user-provided data that can be interpreted by the template engine. When the template engine recognizes these delimiters, it processes the content along with any embedded code.

Example of template engine delimiters

{{ user_input }}

If the application fails to properly sanitize and process the user_input variable, an attacker could execute an SSTI attack using the following malicious input:

{{ 7*7 }}

In this case, the template engine would evaluate the expression and output the result:

49

However, in an SSTI attack scenario, an attacker might use the following input:

{{ 7*'7'.__class__.__mro__[1].__subclasses__()[414]('/etc/passwd').read() }}

This attack leverages Python’s eval() function to execute malicious code that reads the system’s /etc/passwd file.

Examples of SSTI

Example 1: Jinja2 SSTI

Jinja2 is a popular template engine for Python, widely used in web applications. However, directly embedding user input into Jinja2 templates can lead to an SSTI vulnerability.

Sample URL:

https://example.com/search?q={{7*7}}

This URL includes the search query as {{7*7}}. If the application directly inserts this input into a Jinja2 template, the output would be 49.

However, an attacker can attempt an SSTI attack using the following input:

https://example.com/search?q={{7*'7'.__class__.__mro__[1].__subclasses__()[414]('/etc/passwd').read()}}

In this case, the application would use eval() to execute the Python code and read the system’s /etc/passwd file.

Example 2: Handlebars SSTI

Handlebars is a widely used template engine for JavaScript applications. When used in JavaScript applications, SSTI security can be overlooked.

Sample URL:

https://example.com/welcome?name={{name}}

This URL generates a personalized welcome message based on the name variable. If the application fails to sanitize the name variable properly, an attacker can execute an SSTI attack with the following input:

https://example.com/welcome?name={{alert 'XSS'}}

In this case, the application could execute JavaScript code from the username input, potentially causing harm to users.

Preventing SSTI Vulnerabilities

To mitigate SSTI attacks and protect against potential vulnerabilities, consider the following preventive measures:

1. User Input Validation: Always ensure that user inputs are safe and in the expected format. Template engines should not process unsanitized input directly.
2. Context-Aware Escaping: Utilize context-aware escaping to encode user inputs appropriately based on the context in which they will be used. This ensures that potentially harmful code is treated as data and not executed.
3. White list: Take a list approach that only allows certain safe transactions or characters in user input. block or sanitize all entries outside the list.
4. Least Privilege: Restrict the permissions of the template engine or rendering environment to reduce the impact of successful SSTI attacks.

By adopting these preventive measures, developers can enhance the security of their web applications and defend against potential SSTI vulnerabilities.