Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

A Survey of the Overlooked Dangers of Template Engines

Lorenzo Pisu, Davide Maiorca, Giorgio Giacinto

TL;DR

This survey tackles the problem of Remote Code Execution risks arising from Server-Side Template Injection (SSTI) across a broad set of template engines. It systematically analyzes 34 engines in eight programming languages, evaluates RCE paths, and catalogs available protections, finding that 31 engines permit or have permitted RCE while only a minority employ robust defenses (sandboxes being the most common but often unreliable). By collating real-world SSTI CVEs and bug-bounty reports, and contrasting detection tools like Tplmap and ZAP-Esup, the study highlights gaps in current defenses and the need for cross-language, automated detection and hardening. The work also offers a nuanced taxonomy of RCE paths, discusses sandbox evasion (including template escapes), and provides concrete examples of multiple engines to illustrate practical risk and defense considerations. The findings stress the practical impact for developers and security practitioners and call for automated, language-agnostic approaches to assess and mitigate SSTI/RCE risks in modern web applications.

Abstract

Template engines play a pivotal role in modern web application development, facilitating the dynamic rendering of content, products, and user interfaces. Nowadays, template engines are essential in any website that deals with dynamic data, from e-commerce platforms to social media. However, their widespread use also makes them attractive targets for attackers seeking to exploit vulnerabilities and gain unauthorized access to web servers. This paper presents a comprehensive survey of template engines, focusing on their susceptibility to Remote Code Execution (RCE) attacks, a critical security concern in web application development.

A Survey of the Overlooked Dangers of Template Engines

TL;DR

This survey tackles the problem of Remote Code Execution risks arising from Server-Side Template Injection (SSTI) across a broad set of template engines. It systematically analyzes 34 engines in eight programming languages, evaluates RCE paths, and catalogs available protections, finding that 31 engines permit or have permitted RCE while only a minority employ robust defenses (sandboxes being the most common but often unreliable). By collating real-world SSTI CVEs and bug-bounty reports, and contrasting detection tools like Tplmap and ZAP-Esup, the study highlights gaps in current defenses and the need for cross-language, automated detection and hardening. The work also offers a nuanced taxonomy of RCE paths, discusses sandbox evasion (including template escapes), and provides concrete examples of multiple engines to illustrate practical risk and defense considerations. The findings stress the practical impact for developers and security practitioners and call for automated, language-agnostic approaches to assess and mitigate SSTI/RCE risks in modern web applications.

Abstract

Template engines play a pivotal role in modern web application development, facilitating the dynamic rendering of content, products, and user interfaces. Nowadays, template engines are essential in any website that deals with dynamic data, from e-commerce platforms to social media. However, their widespread use also makes them attractive targets for attackers seeking to exploit vulnerabilities and gain unauthorized access to web servers. This paper presents a comprehensive survey of template engines, focusing on their susceptibility to Remote Code Execution (RCE) attacks, a critical security concern in web application development.
Paper Structure (31 sections, 2 figures, 7 tables)

This paper contains 31 sections, 2 figures, 7 tables.

Table of Contents

  1. Introduction
  2. Template Engines And SSTI In The Wild
  3. Template Engines Usage
  4. Real World Examples of SSTI
  5. SSTI Related CVEs
  6. SSTI Scenarios
  7. Template Engines And Server-Side Template Injection
  8. Overview of Template Engines
  9. Why is RCE Often Allowed?
  10. RCE Example
  11. Types of SSTI
  12. Seminal Works On SSTI
  13. Exploitation Methodology
  14. Protecting Against SSTI With Instruction Set Randomization
  15. SSTI Detection Tools
  16. ...and 16 more sections

Figures (2)

  • Figure 1: These plots show how many repositories respond to the template engine search query on GitHub. On the left, we show the number of repositories per year based on the creation date. On the right, we represent the cumulative sum.
  • Figure 2: Components of an application that uses a template engine.