Exploit template injection flaws

Exploit SSTI for remote code execution

RCE via template injection on Jinja2, ERB, and Handlebars endpoints

• · target_endpoint (template render)
• · ssti_payload (jinja2, erb, handlebars)

• · code_execution_proof ({{7*7}}=49, {{config}}, command output)

• · HTTP client
• · SSTI payload library

SSTI endpoint confirmed, template engine identified, permission to inject

• · Sandbox prevents payload execution
• · WAF filters common {{}} patterns
• · Template syntax varies by engine (ERB vs Jinja2)
• · Blind SSTI requires OOB channel

• · Engine-specific payloads ({{7*7}} for Jinja2, <%= system() %> for ERB)
• · Sandbox escape techniques documented
• · Data exfiltration via error messages