Room for Escape: Scribbling Outside the Lines of Template Security (Q&A)

In this deep technical Q&A from the DEF CON Safe Mode Main Stage, security researchers Alvaro Muñoz and Oleksandr Mirosh address inquiries regarding their research into template engine sandbox escapes. Opening at 00:00, the speakers discuss their methodology for discovering Server-Side Template Injection (SSTI) and expression language injection flaws across enterprise web applications.

At 08:00 and 16:03, they explain manual code auditing patterns used to identify template evaluation sinks in enterprise platforms like Microsoft SharePoint, revealing how Java, .NET, and Python sandboxes fail to isolate underlying execution environments.

Concluding at 24:02, the authors highlight supplementary findings published in their comprehensive research whitepaper, advising enterprise developers on safe template rendering practices and input sanitization to prevent remote code execution. (AI summary — Gemini Flash)