Lab: Server-side template injection with information disclosure via user-supplied objects
Summary: This PortSwigger lab is vulnerable to server-side template injection because an object is passed into the template, and the flaw can be exploited to access sensitive data. The goal is to steal and submit the framework's secret key, using provided account credentials and invoking the debug built-in after removing invalid syntax from the template.
Key Takeaway: A template that accepts a user-supplied object can hand an attacker the framework's secret key, and a leaked secret key is the material used to forge signed sessions and tokens.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026