---
description: PRACTICE ! PRACTICE ! PRACTICE !
---

# SSTI

SSTI is a web vulnerability which allows us to take advantage of insecure implementation of **Template Engine**

What is Template Engine ?

> A template engine allows us to create static template files which can be re-used in our application

Consider a page that stores information about a user -  **/profile/user**

```
from flask import Flask, render_template_string 

app = Flask(__name__) 
@app.route("/profile/<user>") 

def profile_page(user): 
	template = f"<h1>Welcome to the profile of {user}!</h1>" 
	return render_template_string(template) 
app.run()
```

The `@app.route` defines the user endpoint, and we are defining a func called `profile_page` which takes one argument called `user` and then assigns the user name to the template variable and renders the template

> Flask is the web framework, while Jinja2 is the template engine being used

#### So how is it Exploitable ?

The variable `user` (which is user input) is concatenated directly into the template, rather than passed in as data. This means whatever is supplied as user input will be interpreted by the engine

> An insecure implementation by the developer leads to template injections, the dev must properly sanitize the user's input

### References

{% embed url="https://jinja.palletsprojects.com/en/2.11.x/api/#jinja2.Environment" %}

{% embed url="https://docs.python.org/release/2.6.4/library/stdtypes.html#class.subclasses" %}

{% embed url="https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection" %}

{% embed url="https://hackerone.com/reports/125980" %}
