PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Server-Side Template Injection

portswigger.net | research | #rce | #web-security | #template-injection | #ssti | #template-engines
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

James Kettle's seminal paper on server-side template injection: a detection and exploitation methodology, generic exploits for five template engines, sandbox escapes and RCE zero-days.
Published
Collected

Related coverage

blog · yeswehack.com
Dojo challenge #53 Hacker Club solution
This technical writeup demonstrates practical payload crafting for Ruby ERB template injection vulnerabilities.
blog · yeswehack.com
Limitations are just an illusion – advanced server-side template exploitation with RCE everywhere
Advanced SSTI research: self-contained RCE payloads built only from default methods for Jinja2, Mako, Twig, Smarty, Blade, Groovy, FreeMarker and Razor, without quotes or external plugins.
vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
vulnerability · labs.cognisys.group
Turning Email Template Injection into Remote Code Execution
Modern web applications rely heavily on automation. Email notifications, document processing alerts, and password recovery workflows are all common features designed to improve usability and streamline operations. Behind the scenes, these features often rely on dynamic templates that allow applications to insert variables into messages before they are sent to users.
vulnerability · vercel.com
Our $1 million hacker challenge for React2Shell
We paid $1M to security researchers to break our WAF. Here's what we learned defending against React2Shell.
research · portswigger.net
XSS without HTML: Client-Side Template Injection with AngularJS
Gareth Heyes explains client-side template injection in AngularJS and presents a fresh sandbox escape affecting Angular 1.3.1+ and 1.4.0+, enabling XSS even when user input is HTML-encoded.
Back