Server-Side Template Injection: When Your Input Becomes Code, Not Data

What it is#

Template engines are meant to fill placeholders in a fixed template with your data. SSTI happens when your input becomes part of the template itself, so the engine compiles and runs it rather than just inserting it.

The labs here#

• NoteForge greeting template RCE: an unsandboxed Twig template takes your input directly. Standard Twig RCE syntax gets you straight to running commands on the server.
• ReportCraft footer sandbox escape: this one runs inside Twig's sandbox, which restricts which methods can be called, but the sandbox only restricts the call itself, not what the return value contains. One allowed method (report.getCustomFields()) happens to leak data the sandbox was never designed to protect.