Info

ID: AT-PE001.002
Technique: Injection Exploitations
Tactic: Payload Execution
Platforms: Linux, macOS, Windows
Supports Remote: Yes
Version: 1.0

Template Injection

Template injection is a sophisticated server-side attack vector where malicious users exploit template engines by injecting template directives into user-controllable input fields processed by these engines. During the Payload Execution phase, attackers leverage template injection vulnerabilities to execute arbitrary code or commands on the target system, bypassing traditional input validation mechanisms. Unlike standard injection techniques, template injection specifically targets the template rendering process where applications dynamically generate content using frameworks like Jinja2, Twig, FreeMarker, or Velocity. The attack works by inserting template syntax (such as {{7*7}} or ${7*7}) that gets evaluated server-side, potentially allowing for sandbox escapes, access to sensitive environment variables, remote code execution, or privilege escalation. This technique is particularly dangerous as it often provides direct access to the application's underlying interpreter and can be difficult to detect through standard security testing methods since it requires understanding of the specific template engine's syntax and evaluation context.

Data Sources

• Application Logs: Template engine execution logs and injection attempt traces
• Web Server Logs: HTTP requests containing template injection payloads
• Template Engine Logs: Template rendering and evaluation activity logs
• Process Monitoring: Process creation and execution resulting from template injection

Detection

ID	Data Source	Detection
DS0015	Application Log	Detect template-render errors such as UndefinedError, TemplateSyntaxError, or unexpected arithmetic results (49 when input was {{7*7}}) originating from external requests.
DS0029	Network Traffic Content	Inspect HTTP bodies/params for template delimiters ({{, {%, ${, <<%) reaching endpoints that don’t normally accept template syntax.
DS0009	Process: Module Load	Alert when template engine loads reflection/OS modules (e.g., os, java.lang.Runtime) outside baseline load graphs, signalling sandbox escape attempts.
DS0022	File: File Modification	Monitor for on-disk changes to compiled template caches immediately after suspicious requests, which may indicate template-shell payload drops.
CADR001	Execution Stack Trace	Identify forbidden code flows executed from a template rendering and execution context.

Mitigations

ID	Mitigation	Description
M1041	Input Validation	Strip or HTML-encode template delimiters from untrusted input before rendering; enforce strong type constraints for rendering context.
M1048	Application Isolation & Sandboxing	Run template engines in locked-down containers/VMs with no interpreter reflection modules installed, preventing execution even if injection succeeds.
M1038	Execution Prevention	Enable template-engine “autoescape/safe mode” and disable eval-style filters or reflection helpers.
M1040	Behavior Prevention on Endpoint	Deploy Cloud Detection & Response (CADR) agents that detect and prevent template injection exploitation attempts.