Description

This detector identifies Server-Side Template Injection (SSTI) vulnerabilities in URL query parameters. SSTI occurs when user-controlled input is embedded into a server-side template and evaluated by the template engine instead of being treated as plain text, allowing attackers to execute arbitrary template expressions and, in the worst case, achieve remote code execution.

Detection Strategy

• Extracts all query parameters from the target URL

• Tests each parameter individually by injecting three Jinja2-style template engine payloads ({{7*7}}, {{7*'7'}}, {{ "fluidtest"|upper }}) that should evaluate to specific values

• Makes HTTP requests with the mutated URLs containing the payloads

• Compares response content against the original baseline response

• Reports a vulnerability when all three payloads for a parameter return responses containing the expected evaluation results (markers) that were not present in the original response

• Requires consistent successful payload execution across all three template injection attempts to confirm the vulnerability