Server-Side Template Injection

Try it out loud first. Then check yourself:

1. SSTI occurs when user input becomes part of a template source rather than data passed into the template
2. Detection: polyglot probes like {{7*7}} or ${7*7} returning 49 and error messages fingerprint the engine
3. Jinja2 escalation walks the object graph (__class__.__mro__, __subclasses__) to reach os or subprocess
4. Impact is usually full RCE as the app user, unlike XSS which is client-side only
5. Fix: never build templates from input, pass it as context; prefer logic-less engines, as sandboxes have been escaped

If the interviewer pushes back

• How would you distinguish SSTI from reflected XSS when {{7*7}} is echoed back unchanged?

Go deeper

• jinja.palletsprojects.com/en/stable/sandbox/