SSTI
Identifying SSTI
Identifying the Template Engine
Injecting the payload ${7*7} into our sample web application results in the following behavior:
Since the injected payload was not executed, we follow the red arrow and now inject the payload {{7*7}}:
Therefore, we follow the green arrow and inject the payload {{7*'7'}}. The result will enable us to deduce the template engine used by the web application. In Jinja, the result will be 7777777, while in Twig, the result will be 49.
PoCs - Questions
Apply what you learned in this section and identify the Template Engine used by the web application. Provide the name of the template engine as the answer.
Exploiting SSTI - Jinja2
Jinja is a template engine commonly used in Python web frameworks such as Flask or Django. This section will focus on a Flask web application. The payloads in other web frameworks might thus be slightly different.
Information Disclosure
We can obtain the web application's configuration using the following SSTI payload:
We can use the following SSTI payload to dump all available built-in functions:
Local File Inclusion (LFI)
We can use Python's built-in function open to include a local file. However, we cannot call the function directly; we need to call it from the __builtins__ dictionary we dumped earlier. This results in the following payload to include the file /etc/passwd:
Remote Code Execution (RCE)
We can use functions provided by the os library, such as system or popen. However, if the web application has not already imported this library, we must first import it by calling the built-in function import. This results in the following SSTI payload:
PoCs - Questions
Exploit the SSTI vulnerability to obtain RCE and read the flag.
First i see if the function 'builtins' is available:
Then, we will import the os module:
And we can execute a command -->
Exploiting SSTI - Twig
Information Disclosure
In Twig, we can use the _self keyword to obtain a little information about the current template:
Local File Inclusion (LFI)
Reading local files (without using the same way as we will use for RCE) is not possible using internal functions directly provided by Twig. However, the PHP web framework Symfony defines additional Twig filters. One of these filters is file_excerpt and can be used to read local files:
Remote Code Execution (RCE)
To achieve remote code execution, we can use a PHP built-in function such as system. We can pass an argument to this function by using Twig's filter function, resulting in any of the following SSTI payloads:
Further Remarks
PoCs - Questions
Exploit the SSTI vulnerability to obtain RCE and read the flag
SSTI Tools of the Trade
Tools of the Trade
To automatically identify any SSTI vulnerabilities as well as the template engine used by the web application, we need to provide SSTImap with the target URL:
As we can see, SSTImap confirms the SSTI vulnerability and successfully identifies the Twig template engine. It also provides capabilities we can use during exploitation. For instance, we can download a remote file to our local machine using the -D flag:
SSTI Tools of the Trade & Preventing SSTI
Additionally, we can execute a system command using the -S flag:
Alternatively, we can use --os-shell to obtain an interactive shell:
Last updated