Server-side template evaluation
User input lands in Jinja, Twig, Freemarker, Thymeleaf, Liquid, Pug, or similar and comes back evaluated. The gadget is the evaluation, not a reverse shell.
Tags: ssti, rce, template
Typical severity: P1-P3
What it becomes
A reflection that evaluates template syntax is RCE-class if the engine is server-side. Prove evaluation with a harmless arithmetic or unique marker first.
Where to look
error pagesemail templatesPDF/HTML renderersnotification titlessearch snippetspreview endpoints
Chains
- RCE: Engine exposes a sandbox escape or a known gadget (Jinja __class__, Freemarker Execute). Stop at the primitive unless the program allows a bounded proof.
- SSRF / file read: Template includes or fetch helpers that take a URL or path from the same input.
- XSS: If evaluation is client-side (Mustache in the browser) it is XSS, not SSTI. Name it correctly.
Notes
- Use a unique arithmetic or a callback-only include. Do not cat /etc/passwd as the first step.
- Client-side template injection is a different report (DOM XSS).