Java

SSTI in Java template engines: FreeMarker's Execute and ObjectConstructor built-ins and Velocity's reflection chain to Runtime.exec.

1 ನಿಮಿಷದ ಓದುಅಕ್ಟೋ 7,2026 ರಂದು ನವೀಕರಿಸಲಾಗಿದೆflorianamette1 ಕೊಡುಗೆದಾರ
ನಿಮ್ಮ ಸಹಾಯಕವನ್ನು ಕೇಳಿ (MCP)GitHub ನಲ್ಲಿ ಸಂಪಾದಿಸಿ

Java template engines reach code execution through the platform's own classes rather than a scripting layer, so exploitation walks to java.lang.Runtime or ProcessBuilder and calls exec. Both engines here use ${ ... } for interpolation, so ${7*7} returning 49 is the shared probe (Velocity also responds to #set($x=7*7)$x).

The difference between them is the gadget: FreeMarker ships utility built-ins (Execute, ObjectConstructor, new) that construct and run objects directly, while Velocity has no such helper and is exploited by reflecting from an available class to Runtime.

Engines#

  • FreeMarker: the Execute, new, and api built-ins, and the new_builtin_class_resolver gate.
  • Velocity: reflection from $class.inspect(...) to Runtime.getRuntime().exec.

References#

  • Apache FreeMarker and Apache Velocity documentation
  • PortSwigger Web Security Academy: Server-side template injection
ಹಿಂದಿನದುTemplatesಮುಂದಿನದು FreeMarker