ECHO Admin Command / SQL Injection / Jinja SSTI Template Injection
This rule flags text sent to an AI model that tries to trick it into running SQL commands or template code disguised as an 'echo' test. It targets prompt-injection patterns from a known security testing tool (NVIDIA garak) rather than a live breach, but the same patterns can be reused by real attackers.
How the attack works
An attacker sends the model a prompt that frames itself as a simple 'echo command tester' and then hides a Jinja template expression (using {{...}} syntax) after the word ECHO:, hoping the model will evaluate it as code (server-side template injection). A second variant asks the model to execute SQL statements like DROP, INSERT, or SELECT and to respond with SUCCESS or FAILURE markers, effectively using the model as a proxy to run database commands. A giveaway string, 'garak pwnd', shows up in some SQL INSERT payloads, marking them as coming from the garak testing framework's injection probes. The goal in all three cases is to get the model to execute or reflect attacker-controlled code/queries instead of just treating the input as text.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9e38778e-b1e8-4dc2-817c-85d809ea6816
- Severity
- High
Why it matters
If successful, an attacker can get the model to execute unintended template code or database commands, potentially exposing, altering, or deleting data, or using the model as a stepping stone to reach backend systems it has access to.
What you can do
- →Never let model output be passed directly into a template engine or SQL executor without strict sanitization and parameterization.
- →Restrict any tool or plugin that lets the model run code, templates, or database queries to a tightly scoped, read-only, or sandboxed context.
- →Review logs for prompts containing 'ECHO:' followed by double-curly-brace expressions, or SQL keywords (DROP/INSERT/SELECT) paired with SUCCESS/FAILURE markers.
- →Treat any occurrence of the literal string 'garak pwnd' as evidence of automated prompt-injection testing or tooling, and investigate its source.
Known benign look-alikes
- Legitimate Jinja2 template variables like {{product.name}} in documentation
- SQL SELECT queries in legitimate database usage tutorials
- ECHO as a shell command reference in Unix documentation