CWE-1336: Improper Neutralization of Special Elements Used in a Template EngineWeakness ID: 1336 Vulnerability Mapping:
ALLOWEDThis CWE ID may be used to map to real-world vulnerabilities Abstraction: BaseBase - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
Description The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine. Extended Description Many web applications use template engines that allow developers to insert externally-influenced values into free text or messages in order to generate a full web page, document, message, etc. Such engines include Twig, Jinja2, Pug, Java Server Pages, FreeMarker, Velocity, ColdFusion, Smarty, and many others - including PHP itself. Some CMS (Content Management Systems) also use templates. Template engines often have their own custom command or expression language. If an attacker can influence input into a template before it is processed, then the attacker can invoke arbitrary expressions, i.e. perform injection attacks. For example, in some template languages, an attacker could inject the expression "{{7*7}}" and determine if the output returns "49" instead. The syntax varies depending on the language. In some cases, XSS-style attacks can work, which can obscure the root cause if the developer does not closely investigate the root cause of the error. Template engines can be used on the server or client, so both "sides" could be affected by injection. The mechanisms of attack or the affected technologies might be different, but the mistake is fundamentally the same. Alternate Terms
Server-Side Template Injection / SSTI: | This term is used for injection into template engines being used by a server. |
Client-Side Template Injection / CSTI: | This term is used for injection into template engines being used by a client. |
Common Consequences This table specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.Scope | Impact | Likelihood |
---|
Integrity
| Technical Impact: Execute Unauthorized Code or Commands | |
Potential Mitigations
Phase: Architecture and Design Choose a template engine that offers a sandbox or restricted mode, or at least limits the power of any available expressions, function calls, or commands. |
Phase: Implementation Use the template engine's sandbox or restricted mode, if available. |
Relationships This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore. Relevant to the view "Research Concepts" (CWE-1000) Nature | Type | ID | Name |
---|
ChildOf | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 94 | Improper Control of Generation of Code ('Code Injection') | PeerOf | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 917 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') |
Modes Of Introduction The different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.Phase | Note |
---|
Architecture and Design | The developer might choose a template engine that makes it easier for programmers to write vulnerable code. | Implementation | The programmer might not use engine's built-in sandboxes or other capabilities to escape or otherwise prevent template injection from untrusted input. |
Observed Examples Reference | Description |
| Chain: Python bindings for LLM library do not use a sandboxed environment when parsing a template and constructing a prompt, allowing jinja2 Server Side Template Injection and code execution - one variant of a "prompt injection" attack. |
| server-side template injection in content management server |
| authentication / identity management product has client-side template injection |
| Server-Side Template Injection using a Twig template |
| devops platform allows SSTI |
| bypass of Server-Side Template Injection protection mechanism with macros in Velocity templates |
| web browser proxy server allows Java EL expressions from Server-Side Template Injection |
| SSTI involving mail templates and JEXL expressions |
| product does not use a "safe" setting for a FreeMarker configuration, allowing SSTI |
| product allows read of sensitive database username/password variables using server-side template injection |
Memberships This MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources. Vulnerability Mapping Notes Usage: ALLOWED (this CWE ID could be used to map to real-world vulnerabilities) | Reason: Acceptable-Use | Rationale: This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities. | Comments: Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction. |
Notes Relationship Since expression languages are often used in templating languages, there may be some overlap with CWE-917 (Expression Language Injection). XSS ( CWE-79) is also co-located with template injection. Maintenance The interrelationships and differences between CWE-917 and CWE-1336 need to be further clarified. References
More information is available — Please edit the custom filter or select a different filter.
|