version: "1.0.0" name: ssti description: Hunt server-side template injection across Jinja2/Twig/Freemarker/Velocity/Handlebars and validate progression from expression injection to code execution. metadata: subdomain: web-exploitation when_to_use: "ssti server side template injection jinja2 twig freemarker velocity handlebars expression code execution"
SSTI Playbook
High-signal checks
- Look for template rendering with user input in
render_template_string, Template(...), twig->createTemplate, Freemarker Template.process. - Confirm user-controlled payload reaches a template context key or template source string.
Fast probes
- Jinja2:
{{7*7}}, {{config}}, {{request}} - Twig:
{{7*7}}, {{_self}} - Freemarker:
${7*7} - Velocity:
#set($x=7*7)$x
Escalation path
- Detect expression evaluation.
- Enumerate available objects and filters.
- Attempt file read / env leak.
- Attempt command execution via framework-specific gadget chain.
Validation
Use validate_finding with a positive execution signal and a benign negative control.