Collected research
Server-Side Template Injection: RCE for the Modern Web App
2015 - James Kettle - Server Side Template Injection: RCE for the Modern Web App
User input concatenated into a server-side template is executed by the template engine, not just reflected, so it looks like XSS while actually running code on the server. The paper gives a detect-identify-exploit methodology and working sandbox escapes to remote code execution for FreeMarker, Velocity, Smarty, Twig and Jade, plus zerodays in Alfresco and XWiki.
Record
- Document
- 2015 - James Kettle - Server Side Template Injection: RCE for the Modern Web App
- Researcher
- James Kettle
- Published by
- PortSwigger
- Date
- Format
- Recording
- Topic
- Injection
In the archive
Related sources
- Server-Side Template Injection: RCE for the Modern Web App Whitepaper
- Server-Side Template Injection: RCE For The Modern Web App
Tags
This page is the archive's own catalogue record. The research is the work of James Kettle, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .