hunt-ssti

To test for server-side template injection, use mathematical probe expressions to fingerprint the underlying template engine, then apply engine-specific payloads to confirm if user-supplied input in features like email templates or PDF generators allows remote code execution.

Server-side template injection allows remote code execution by exploiting engine-specific class-walker and callback-registrar patterns to escalate simple template reflections into full command execution within the target application's runtime environment.

Yes, you can detect template injection across engines like Jinja2, Twig, and Freemarker by using engine fingerprinting techniques that evaluate mathematical probe expressions to systematically identify the specific template rendering engine in use.

The best way to audit CMS preview endpoints for template injection is to systematically test input fields against common engine payloads, targeting features that render user-supplied input to verify vulnerability impact and potential remote code execution.

You should evaluate class-walking patterns during vulnerability research when confirming server-side template injection impact, as these engine-specific callback-registrar mechanisms are required to successfully escalate from initial detection to full remote code execution.