Server-side template injection vulnerabilities can expose websites to a variety of attacks depending on the template engine in question and how exactly the application uses it. What is the impact of server-side template injection? As the name suggests, server-side template injection payloads are delivered and evaluated server-side, potentially making them much more dangerous than a typical client-side template injection. This allows attackers to inject arbitrary template directives in order to manipulate the template engine, often enabling them to take complete control of the server. Server-side template injection attacks can occur when user input is concatenated directly into a template, rather than passed in as data.

Template engines are designed to generate web pages by combining fixed templates with volatile data.

Server-side template injection is when an attacker is able to use native template syntax to inject a malicious payload into a template, which is then executed server-side. Research Server-side template injection What is server-side template injection?

Pug template injection