Which injection occurs when server-side templates are influenced by unsafe user input?

Which injection occurs when server-side templates are influenced by unsafe user input?

• A. Server-side Template Injection
• B. Server-side Includes
• C. Log injection attacks
• D. LDAP Directory Services

Answer: (A)

Server-side template injection happens when untrusted input is used to influence the template engine that renders a web page. Template engines combine data with template code, and if user input is inserted into the template itself rather than treated purely as data, the engine may interpret that input as part of the template. This can allow an attacker to alter how the page is rendered or even execute unintended code on the server, depending on the language and engine in use. That’s exactly the situation described: unsafe user input shaping the server-side template. The other options refer to different attack surfaces. Including files on the server (server-side includes) is about file inclusion rather than injecting template logic. Log injection targets the logging mechanism with crafted input. LDAP-related issues involve directory queries, not template rendering.

Server-side template injection happens when untrusted input is used to influence the template engine that renders a web page. Template engines combine data with template code, and if user input is inserted into the template itself rather than treated purely as data, the engine may interpret that input as part of the template. This can allow an attacker to alter how the page is rendered or even execute unintended code on the server, depending on the language and engine in use. That’s exactly the situation described: unsafe user input shaping the server-side template.

The other options refer to different attack surfaces. Including files on the server (server-side includes) is about file inclusion rather than injecting template logic. Log injection targets the logging mechanism with crafted input. LDAP-related issues involve directory queries, not template rendering.