Description

This detector identifies Server-Side Template Injection (SSTI) vulnerabilities in web application forms by submitting malicious template expressions in form fields and analyzing the response for evidence of server-side template evaluation. SSTI vulnerabilities can allow attackers to execute arbitrary code on the server by injecting template syntax that gets processed by the server's template engine.

Detection Strategy

• Scans HTML content to find all POST forms on the target webpage

• For each form found, extracts input fields that can be tested for injection vulnerabilities

• Submits HTTP POST requests with malicious template injection payloads in form fields (such as template expressions that would be evaluated by common template engines)

• Analyzes the HTTP response content to detect if the injected template expressions were executed by the server

• Reports SSTI vulnerability when the response shows evidence that template code was processed server-side, indicating the application is vulnerable to template injection attacks