> For the complete documentation index, see [llms.txt](https://yasmeen-rezk.gitbook.io/my-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yasmeen-rezk.gitbook.io/my-notes/bug-bounty-playbook-v2/more-owasp/csti.md).

# CSTI

Client-Side Template Injection

### <mark style="color:yellow;">Angular Basics</mark>

#### Description

Angular is a client-side template framework and you can embed user input into these templates.

#### Template

An HTML snippet that tells Angular how to render the component in an Angular application.

* allows to dynamically generate HTML code based on the arguments passed to it.
* Ex: \<h1>Welcome {{Username}}!\</h1>

#### Expressions

Expressions are Javascript-like code snippets that can contain literals, operators, and variables.

* Angular expressions are evaluated against the Scope object.
* Ex: “{{Username}}”

#### Scope Object

The scope is just an object and you can define variables and functions in it.

By default, the scope object contains another object called “constructor” which contains a function also called "constructor":

* used to dynamically generate and execute code.

<figure><img src="https://509923538-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ2ZeCCTH4XZTY31hlbGx%2Fuploads%2FZggGK8awaHzkGF0VfglS%2Fimage.png?alt=media&amp;token=dfa80349-4ba2-4671-a3c3-926cfb32180d" alt=""><figcaption></figcaption></figure>

### <mark style="color:yellow;">CSTI</mark>

#### Description

Arises when applications using a client-side template framework dynamically embed user input in web pages.

#### Impact

Used to trigger XSS payloads.

#### Indicators

Try to use the expression “{{1+1}}” which gets evaluated to “2” -> app vulnerable to CSTI.

#### Prevention

Using sandbox.

### <mark style="color:yellow;">CSTI (XSS)</mark>

💡NOTE: search for sandbox bypass for the Angular version to get the XSS payload to execute.

Inject an Angular expression payload:

* {{constructor.constructor('alert(1)')()}}

<figure><img src="https://509923538-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ2ZeCCTH4XZTY31hlbGx%2Fuploads%2FhOhFKLkHo6LpmAjv5IUs%2Fimage.png?alt=media&amp;token=052a1b15-258a-4484-806b-4fbf04b2ec30" alt=""><figcaption></figcaption></figure>

The page causes the application to dynamically generate and execute our payload!