Security Test: SSTI (Server-Side Template Injection)¶

Description¶

Default Severity: high

Server-Side Template Injection happens when an attacker gets control over a web page's template by injecting content that the server then processes. This usually occurs when user input is directly embedded into a template without proper validation or filtering. Because templates often include powerful built-in functions, if an attacker can control the template, they might even run system commands, access sensitive data, or execute unwanted operations on the server. Developers often fall into the trap of not sanitizing inputs properly or misconfiguring template engines, leaving the door open for serious risks like unauthorized data exposure or complete server compromise if the vulnerability is exploited.

Reference:

• https://portswigger.net/web-security/server-side-template-injection

Configuration¶

Identifier: injection/ssti

Examples¶

All configuration available:

checks:
  injection/ssti:
    skip: false # default

Compliance and Standards¶