3 articles tagged with ""ssti""
Server-Side Template Injection is what happens when you let users write inside your templates. Spoiler: they won't write 'Hello World'.
You built a slick email system that lets users customize their messages. Cute. Now a hacker is using your Jinja2 template to read your /etc/passwd file and spawn a shell. Learn how SSTI turns friendly curly braces into a remote code execution nightmare — and how to stop it.
You gave users a way to customize their welcome email. They used it to execute commands on your server. SSTI is the vulnerability where innocent-looking template syntax becomes a one-way ticket to full server compromise.