Server-Side Template Injection (SSTI)

Vulnerability Details

Severity:

Critical

Category:

Web Application

Description

The application embeds user input into server-side templates without proper sanitization, allowing attackers to inject template directives that execute arbitrary code on the server.

Risks

Successful exploitation can lead to remote code execution, full server compromise, data exfiltration, and lateral movement within the infrastructure.

Remediation

Never pass user input directly into template strings. Use logic-less template engines where possible. Sandbox template execution environments. Validate and sanitize all user input before template processing.