An Assessment of the Overlooked Dangers of Template Engines
Lorenzo Pisu, Davide Maiorca, Giorgio Giacinto

TL;DR
This paper thoroughly examines the security risks of template engines, especially focusing on Server-Side Template Injection (SSTI) vulnerabilities that can escalate to Remote Code Execution (RCE), highlighting overlooked dangers in web development.
Contribution
It provides a comprehensive assessment of SSTI vulnerabilities in template engines and emphasizes their potential for severe security breaches like RCE.
Findings
SSTI vulnerabilities are common in popular template engines.
Exploiting SSTI can lead to RCE with minimal effort.
Many web applications remain vulnerable due to overlooked risks.
Abstract
Template engines play a pivotal role in modern web application development by enabling the dynamic rendering of content, products, and user interfaces. Today, they are essential for any website that handles dynamic data, from e-commerce to social media. However, their widespread adoption also makes them attractive targets for attackers seeking to exploit vulnerabilities and gain unauthorized access to web servers. This paper presents a comprehensive assessment of the risks associated with template engines, with a particular focus on the consequences of Server-Side Template Injection (SSTI) and the ease with which such vulnerabilities can escalate to Remote Code Execution (RCE), a critical security concern in web application development.
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
