Room for Escape: Scribbling Outside the Lines of Template Security
Alvaro Muñoz and Oleksandr Mirosh uncover server-side template injection (SSTI) RCE vulnerabilities across leading enterprise Content Management Systems.
Summary
Server-Side Template Engines in Enterprise CMS
Modern Content Management Systems (CMS) rely heavily on template engines (such as Freemarker, Velocity, and Twig) to dynamically render user-customized web content.
The Evolution of Server-Side Template Injection (SSTI)
Alvaro Muñoz and Oleksandr Mirosh explore the mechanics of SSTI, analyzing how template engines expose internal programming language reflection and class loaders.
Bypassing Template Sandboxes to Achieve RCE
Dissecting popular enterprise CMS platforms reveals novel sandbox bypass techniques, allowing attackers to invoke native operating system commands through template directives.
Hardening Template Engines and Defenses
The researchers release open-source security guidelines and secure configuration baselines for developers to sandbox template execution safely.
Related talks
Main Stage·32 min
Alvaro Muñoz · Oleksandr Mirosh
Alvaro Muñoz and Oleksandr Mirosh answer questions on Server-Side Template Injection, CMS template engine sandboxes, and secure coding.
Main Stage·36 min
Jeffrey Hofmann
Jeffrey Hofmann details discovering multiple pre-authentication remote code execution chains in Quest KACE Systems Management Appliance (SMA).
Main Stage·45 min
Aaditya Purani · Max Garrett
Aaditya Purani and Max Garrett expose systemic Electron framework misconfigurations, turning standard web XSS into remote code execution across popular desktop apps.