Home / Knowledge hub / Server-side template injection
Knowledge hub
Server-side template injection
User input evaluated by your template engine, often leading to code execution.
What it means
A template engine builds pages and emails by filling placeholders in a template with data. Server-side template injection happens when user input becomes part of the template itself rather than data placed into it, so the engine runs the input as instructions.
The giveaway is arithmetic. If a name field containing a small sum, written in the engine's own syntax, comes back as the answer on the page, then the server is evaluating what the visitor typed. Once that happens, the visitor is no longer filling in a form; they are writing part of your program.
Why it matters
Template engines are powerful, and what they can do is often close to running code on the server. That is why this weakness is rated so seriously: it can lead to reading files, exposing secrets and keys, and full remote code execution. MITRE lists it as CWE-1336.
The result is a server controlled from a web form. One bug can expose environment variables, database credentials, customer data and a way to move deeper into your network, which turns a small input flaw into a breach. Fixing it later means auditing every place a template is built.
How it shows up
You meet it in email builders, report and invoice generators, marketing page editors, custom notification messages and any feature where a customer can write their own template. Another frequent cause is code that builds a template string by joining user text into it, and then renders the result.
The fix is to pass user input as data and never as template text. Keep templates in files under your control, and prefer engines with limited logic. If customers must write templates, use a sandbox, restrict what it can reach, and run the renderer with minimal permissions. Test with harmless expressions. See injection.
Questions people ask
Server-side template injection, answered
What is the difference between SSTI and XSS?
XSS runs the attacker's script in a visitor's browser. Server-side template injection runs the attacker's expression on your server.
The server-side version is generally more severe because it can reach your files, secrets and network.
Which template engines are affected?
Any engine can be, including popular ones in Python, Java, PHP, Ruby and JavaScript, when user input is placed into the template text.
The cause is how the code uses the engine, not a flaw in one product.
Are logic-less templates safe?
They greatly reduce the risk, since they cannot run much code. They still need user input to be data, and a poorly handled value can cause other problems.
Safer, but not a reason to skip testing.
How do I test for template injection?
Submit a harmless expression such as a small sum in the engine's syntax into fields that reach pages or emails, and see if the result is calculated.
Do this in an authorised test only, and stop at proof.
Can customers safely edit their own templates?
Only with care. Use a sandboxed engine, expose a short list of safe variables, and run rendering in a restricted process.
Many teams choose a limited markup language instead of a full template engine.
Related
Terms that sit next to this one
Injection
Input that ends up running as a command instead of being read as text.
Remote code execution
Getting a server to run commands of an attacker's choosing.
Expression language injection
Input evaluated as an expression by a framework, which can run code.
Untrusted input
Anything that arrived from outside your own code, and is therefore suspect.
Output encoding
Escaping data for its destination so it is shown as text, not run as code.
Is typed text treated as code?
Email builders and custom message fields are classic places for it. We test them and report only what was evaluated, with the request, the response and, in white-box mode, the line of code. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.