WebOTG-INJ-004 — Server-Side Template Injection (SSTI) Defense

1. Executive Summary & Scope

Server-Side Template Injection (SSTI) occurs when user-supplied input is embedded directly into template source code rather than passed as data parameters to a compiled template. Template engines parse the user input as template directives, granting the attacker access to internal template helper functions, object properties, and server execution contexts.

Standard Classification

OWASP Standard: OWASP Top 10 • Mapping: CWE-1336 • Target Architecture: Public Web Systems & APIs

2. Threat Model & Attack Vectors

Attackers inject template expressions such as `{{7*7}}` or `{{system('id')}}` into email templates or dynamic web pages, escalating from template evaluation to remote code execution.

3. Code Analysis & Remediation Playbook

Vulnerable Implementation Pattern

// VULNERABLE: Compiling user input directly as template source string $userInput = $_POST['custom_greeting']; // e.g. "Hello {{ 7*7 }}" $template = $twig->createTemplate("User greeting: " . $userInput); echo $template->render();

Hardened Defense-in-Depth Implementation

// REMEDIATED: Static pre-compiled template with parameter binding // Never concatenate user input into template source structure! $userInput = (string)$_POST['custom_greeting']; // Pass untrusted input strictly as data context to immutable template $template = $twig->load('greetings/custom.html.twig'); echo $template->render([ 'user_greeting' => $userInput // Twig automatically auto-escapes data variables ]);

4. Audit Verification Checklist & Pass Criteria

Verification Phase	Audit Test Description	Mandatory Passing Criteria
Math Expression Probing	Submit `{{77}}`, `${77}`, `<%= 7*7 %>` to dynamic string fields.	Application renders literal text string `{{7*7}}` without calculating numerical result (49).
Global Object Access Fuzzing	Attempt accessing template environment variables (e.g. `{{_self.env}}`).	Template engine throws compilation error or renders sanitized empty output.
Sandbox Security Audit	Ensure template engine runs in restricted sandbox mode if allowing user-customized templates.	Arbitrary function invocation and class instantiation disabled in template environment.

WebOTG Application Security Directorate

Senior Security Auditor

WebOTG provides benchmark reference documentation, automated matrix evaluators, and security test harnesses for government digital platforms, WQMS architectures, and STQC compliance frameworks.