SSTI in Freemarker

Fuzzing vulnerable payloads in request body and query params to assess Server-Side Template Injection vulnerability.

Server Side Template Injection (SSTI)

Impact of the vulnerability

Server-Side Template Injection (SSTI) allows attackers to execute arbitrary code on a server, leading to data exposure, remote code execution, and potential server compromise, posing severe security and privacy risks.

How this template works

APIs Selection

The template uses regular expressions to match any request payload or query parameter key. It then extracts the matched key and assigns it to either "payloadKey" or "queryKey" for further use.

Execute request

The template modifies the query parameter "queryKey" by injecting the value "%24%7B89%20*%2091%7D", which represents the expression "${89*91}". Similarly, it modifies the request body parameter "payloadKey" by injecting the expression "${89*91}". These modifications aim to test for Server-Side Template Injection vulnerabilities.

Validation

The template validates the response payload by checking if it contains either the string "8099". This ensures that the executed request has successfully triggered the expected behavior related to Server-Side Template Injection.

Frequently asked questions

What is Server-Side Template Injection (SSTI) and how does it pose a security risk in the context of FreeMarker templates

How does the SSTI_IN_FREEMARKER test identify and exploit Server-Side Template Injection vulnerabilities specific to FreeMarker templates

What are the potential impacts of a successful Server-Side Template Injection attack, including the risks of arbitrary code execution, data exposure, and server compromise

How does the test modify the request payload and query parameters to fuzz vulnerable payloads and assess the presence of SSTI vulnerabilities

What are the specific selection filters used in the test to identify relevant request payloads and query parameters for fuzzing

How does the test validate the response payload to determine if the SSTI vulnerability has been successfully exploited, specifically looking for the presence of the value '8099'

Loved by security teams!

"We are absolutely thrilled with the testing feature of Akto. We have used it on our graphQL endpoints and it performs flawlessly identifying common API security issues. It's truly a game-changer and we highly recommend Akto to anyone looking to effortlessly secure their API endpoints. With a user-friendly interface, it's the perfect solution for anyone looking to embrace custom rules with context to reduce false positives."

Security team,

Loom

Security team,

Loom

Security team,

Loom

"The text editor in Akto is absolutely remarkable. Its user-friendly YAML format strikes the perfect balance between simplicity and power. With intuitive features like 'API selection filter', 'Execute', Validate' creating test rules becomes incredibly easy. Akto's test editor is a game-changer, enabling seamless creation of highly personalized and effective tests that could meet the needs of any modern day organization. "

Security team,

Rippling

Security team,

Rippling

Security team,

Rippling

Explore other tests

SSTI in Flask and Jinja

SSTI in Twig

Learn more:

Content

6 mins

(SSTI) Server-side Template Injection: Explanation, Discovery, Exploitation, and Prevention

Content

10 min read

What's changed in OWASP API Security Top 10 2023 Release Candidate from 2019?

Suggest API security tests

We're actively building the test library. Suggest a test! If we like your suggestion, you will see it in the library in few days.