domains / families / security / ssti-server-side-template-injection

ssti-server-side-template-injection

separate

SSTI playbook. Use when template expressions, server-side rendering, preview features, or templating engines may evaluate attacker-controlled content.

When to use

• template expressions
• server-side rendering
• preview features
• templating engines
• polyglot detection probes
• engine fingerprinting
• Jinja2/FreeMarker/Twig/ERB RCE chains
• client-side Angular SSTI

When not to use

• PHP CMS template eval
• Jira SSTI
• Confluence OGNL
• Spring Cloud Gateway SpEL

Skill page

Source