exploiting-template-injection-vulnerabilities

Inject arithmetic expressions like {{7*7}}, ${7*7}, #{7*7}, and <%= 7*7 %> into user-controlled parameters and check whether the response contains the computed result 49. A computed value proves server-side evaluation, while a literal reflection of 7*7 means no template execution at that syntax.

Use the divergence test: {{7*'7'}} returns 7777777 on Jinja2 but 49 on Twig, while ${7*7} evaluating indicates Freemarker or Velocity and #{7*7} indicates Thymeleaf or Ruby. Engine-specific RCE payloads only work after correct fingerprinting, and tplmap can automate detection.

SSTI executes template directives on the server, proven when an expression like {{7*7}} renders as the computed value 49 rather than echoed text. Reflected XSS only echoes input back to the browser without server-side evaluation, so it cannot reach server objects or achieve server-side code execution.

Yes, blind SSTI uses out-of-band techniques such as an OOB payload that triggers the server to make a request to an attacker-controlled host, for example via os.popen with curl. Also test asynchronous sinks like email templates, PDF generators, and error pages that render input later.

tplmap and SSTImap automate detection, engine identification, OS command execution, and file download for SSTI vulnerabilities. Burp Suite Intruder with SSTI payload lists and grep matching on indicators like 49 or error messages supports manual fuzzing workflows.

WAFs often strip common delimiters like {{ but may miss {% or URL-encoded braces, so test both raw and encoded payload variants. A polyglot string can also reveal the engine through partial rendering or error messages when standard delimiters are filtered.