Server-Side Template Injection: Exploiting Tornado Templates — SSTI Labs
[Write-up] Server-Side Template Injection (Code Context) in Tornado Templates.
Server-Side Template Injection: Exploiting Tornado Templates — SSTI Labs
[Write-up] Server-Side Template Injection (Code Context) in Tornado Templates.
Introduction
Server-Side Template Injection (SSTI) is a security vulnerability that occurs when user input is embedded unsafely into a server-side template. This vulnerability allows attackers to inject malicious code into templates, potentially leading to arbitrary code execution, data leaks, or server compromise.
Server-Side Template Injection (Code Context)
SSTI arises from the unsafe handling of user-provided input in server-side templates. If input is directly concatenated or interpolated into templates without proper validation or sanitization, it creates an avenue for attackers to exploit template engine features and execute unintended actions.
Disclaimer: The techniques described in this document are intended solely for ethical use within the controlled environment of PortSwigger Labs for educational and training purposes. Unauthorized use of these methods outside approved environments is strictly prohibited, as it is illegal, unethical, and may lead to severe consequences.
It is crucial to act responsibly, comply with all applicable laws, and adhere to established ethical guidelines. Any activity that exploits security vulnerabilities or compromises the safety, privacy, or integrity of others is strictly forbidden.
Table of Contents
- **Summary of the Vulnerability**
- **Steps to Reproduce & Proof of Concept (POC)**
- **Impact**
- **Mitigation**
Summary of the Vulnerability
This lab is vulnerable to Server-Side Template Injection (SSTI) because it unsafely incorporates user-provided input into a Tornado template. Tornado is a Python-based web framework, and its template engine is powerful but can be misused if input validation is inadequate.
Objectives:
- Review Tornado’s documentation to identify methods for executing arbitrary code through the template engine
- Use this information to delete the
**morale.txt** file located in Carlos's home directory
Steps to Reproduce & Proof of Concept (POC)
- Access the SSTI Lab and Login using the credentials (username: wiener and password: peter)
-
Notice 2 input fields: Email parameter and Prefered name parameter
-
Initial testing on Email parameter. Update the email for the user wiener
- Review findings after updating Email
-
If no obvious vulnerabilities are found, proceed to test the Preferred Name field.
-
Choose the Nickname option for testing.
- Try to submit a comment on any article in the Lab
- Notice that the displayed comment includes the nickname of the wiener’s account
-
Go back to Burp Suite’s history
-
Right-click the
**POST /my-account/change-blog-post-author-display** request and send it to Repeater for further inspection
-
The body of the request includes the parameter
**blog-post-author-display=user.nickname** -
Inject the basic payload, such as:
}}{{7*7}}
- Refresh the browser and observe the results. The nickname appears with additional output
**49(the result of `7*7`**) and two curly brackets.
-
This indicates the presence of a Server-Side Template Injection (SSTI) vulnerability
-
According to the Objectives, the Lab utilizes the Tornado Template engine
-
Refer to the Tornado Template documentation for further understanding [LINK]
-
Tornado Template executes Python code using the syntax:
{% python-code %}- Modify the payload to leverage Python’s
**os** module for command execution then break out of the expression
}}{%25+import+os+%25}{{os.system('rm%20/home/carlos/morale.txt')
Note: Use URL-encode (Cyberchef)
**%→`%25`**
-
Submit the modified payload via Burp Suite, then refresh the browser
-
If successful, the lab will be solved
Impact
- Attackers can execute arbitrary code on the server, gaining unauthorized access to sensitive resources
- Confidential information stored on the server may be exposed
Mitigation
- Disable or restrict features in the template engine that allow for arbitrary code execution
- Ensure the template engine and related dependencies are up-to-date with the latest security patches
Source: PortSwigger Labs
Thank you for taking the time to read and follow this tutorial.
메타데이터
- post_id
- 65bbff351f6a
- slug
- server-side-template-injection-exploiting-tornado-templates-ssti-labs-65bbff351f6a
- url
- https://medium.com/@bashoverflow/server-side-template-injection-exploiting-tornado-templates-ssti-labs-65bbff351f6a
- canonical_url
- https://medium.com/@bashoverflow/server-side-template-injection-exploiting-tornado-templates-ssti-labs-65bbff351f6a
- author_url
- https://medium.com/@bashoverflow
- status
- ok
- fetched_at
- 2026-09-01 02:18:10
